🔴 Critical | Source: Krebs on Security
Connor Riley Moucka, a 26-year-old Canadian, has pleaded guilty to hacking and extorting over 165 organisations that used the Snowflake cloud data platform, in one of 2024’s most damaging cybercrime campaigns. The attacks exploited poor credential hygiene — specifically the absence of multi-factor authentication on Snowflake accounts — allowing mass data theft including over 100 million AT&T customer records. The case underscores the severe real-world consequences of inadequate access controls on cloud data warehousing platforms.
Security Architect’s Take: Audit all Snowflake (and wider SaaS data platform) accounts immediately to enforce MFA and review whether single-factor credentials are used anywhere in your data pipeline; also assess whether network policy objects in Snowflake restrict access to known IP ranges, as both controls would have significantly limited the blast radius of this campaign.
Original advisory: Canadian Man Pleads Guilty in Snowflake Extortions