# Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

Source: [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html) · 2026-11-09 · Security
Page: https://themorning.dev/story/hackers-exploit-qubole-s-trusted-aws-access-to-breach-customer-accounts-and-stea-bd73ebc7b854e9ac
Kind: security · Impact: high

## In brief

- A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
- Between October 14 and October 26, the attacker broke into AWS accounts of multiple Qubole customers and stole stored secrets and data, according to Wiz.
- Wiz published its observations and guidance on how to hunt for this activity on 2026-11-09.

## Why it matters

If your AWS accounts trust Qubole's integration roles, that trust path was used to reach customer data and secrets, so those accounts should be checked and their stored secrets treated as potentially exposed.

## What to do

- Review the hunting guidance in the Wiz blog post and check your AWS accounts for abuse of Qubole integration roles
- Check whether secrets stored in AWS accounts integrated with Qubole may have been exposed and rotate them if so

## Timeline

- 2026-10-14: Start of the reported window of attacker access to multiple Qubole customers' AWS accounts
- 2026-10-26: End of the reported window of attacker access to Qubole customers' AWS accounts
- 2026-11-09: Wiz publishes its findings on the abuse of Qubole cross-account access

## Coverage

- [Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data](https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html) — The Hacker News, 2026-11-09
- [Trusted by Default: Qubole Cross-Account Access Abused in the Wild](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild) — Wiz Blog | RSS feed, 2026-11-09

Tags: qubole, aws, cloud-security, data-breach, iam, supply-chain

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev