Fast Facts
- Qubole-linked AWS accounts were breached Oct. 14–26: An attacker used Qubole’s AWS credentials to assume customer roles; how the credentials were obtained remains unknown.
- Secrets and data were exposed: The attacker accessed stored credentials and copied S3 data, sometimes downloading entire buckets.
- Investigate CloudTrail from Oct. 1 onward: Check for suspicious AssumeRole activity from Qubole’s AWS account, especially requests originating outside AWS; review related access to Secrets Manager, SSM, Lambda, and S3.
- Contain and prevent further access: Rotate exposed credentials, revoke active sessions, remove unused Qubole roles, tighten role permissions and trust policies, and enable S3 data-access logging.
An attacker used Qubole’s trusted access to enter multiple customer accounts on Amazon Web Services (AWS) from October 14 to October 26, according to a security investigation. The attacker took stored credentials and copied data from cloud storage. Investigators have not disclosed how the attacker obtained the Qubole account credentials or whether the company has disabled them.
Trusted Access Became a Way In
Qubole’s data platform connects to customer AWS accounts through roles that grant it specific permissions. Those roles continued to trust Qubole even when customers no longer used them. As a result, the attacker could use Qubole’s access to enter some accounts.
Once inside, the attacker searched for credentials in cloud functions and storage services. The attacker also copied files from accessible storage buckets, sometimes downloading an entire bucket. This case shows how a useful vendor connection can create risk when companies leave old permissions in place or grant broad access.
A separate incident involved customer AWS access keys between October 8 and October 11. Investigators have not linked that activity to the later abuse of Qubole’s trusted access.
What AWS Customers Can Do
Organizations that connected Qubole to AWS should review CloudTrail records from October 1 onward, including accounts that no longer use the service. They should investigate unusual access requests, then examine actions involving stored credentials, cloud functions, and storage buckets.
If a suspicious session reached an account, teams should change exposed credentials and end active sessions. They should also remove unused roles, narrow each vendor’s permissions, and limit access to approved network locations. Finally, they should enable detailed storage logs. Basic account records may show that someone accessed a bucket, but not which files they read.
Cloud services can help teams manage and analyze data at scale. However, safe adoption depends on treating every vendor connection as an ongoing responsibility—not a one-time setup.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
