International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 47 · Tier B2 sources

Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

The Hacker News ·

Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

The Brief · written from 2 sources

  • A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
  • Between October 14 and October 26, the attacker broke into AWS accounts of multiple Qubole customers and stole stored secrets and data, according to Wiz.
  • Wiz published its observations and guidance on how to hunt for this activity on 2026-11-09.

Why it matters

If your AWS accounts trust Qubole's integration roles, that trust path was used to reach customer data and secrets, so those accounts should be checked and their stored secrets treated as potentially exposed.

Who’s affected

  • Qubole customers with AWS integration roles

What to do

  1. Review the hunting guidance in the Wiz blog post and check your AWS accounts for abuse of Qubole integration roles
  2. Check whether secrets stored in AWS accounts integrated with Qubole may have been exposed and rotate them if so

An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those…

Read the full story at thehackernews.com ↗

Timeline

  1. Start of the reported window of attacker access to multiple Qubole customers' AWS accounts

  2. End of the reported window of attacker access to Qubole customers' AWS accounts

  3. Wiz publishes its findings on the abuse of Qubole cross-account access

  4. Wiz Blog | RSS feed

    Trusted by Default: Qubole Cross-Account Access Abused in the Wild

  5. The Hacker News

    Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

Full coverage · 2 sources

How do you feel about this?

0 Comments