Wiz says attacker breached multiple Qubole customers' AWS accounts
Wiz said an attacker accessed AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data.
Written by a model from the sources below. Verify against them.
- Vendor
- Qubole
- Product
- AWS IAM
- Status
- Reported, not confirmed
- Disclosed
- Data taken
- Tokens and keys
Summary
The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers, and how those credentials were obtained has not been disclosed.
What to do
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it
For tokens and keysRotate secrets and credentials stored in AWS accounts connected to Qubole
Review AWS CloudTrail logs for activity between October 14 and October 26
Revoke and audit cross-account roles and access granted to Qubole
Check with Qubole or Idera for confirmation of whether your account was affected
Timeline
- Made public by The Hacker News
- First seen by cve.now
- Posted on X by cve.now
What was taken
| Taken | Per the source |
|---|---|
| Tokens and keys | The Hacker News: “It read environment variables for Lambda functions, pulled secrets from Secrets Manager, and read values from the SSM Parameter Store.” |
Evidence 8
- PressThe Hacker News
“An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.”
- SocialBluesky
“Qubole IAM role exploit let attackers leak secrets & data via AWS trust policy abuse.”
- SocialBluesky
“A malicious campaign targeted cloud environments connected to the data lake platform Qubole between October 14 and October 26.”
- Social
- SocialMastodon
“The intruder exploited Qubole's own AWS credentials to gain unauthorized access to customer environments.”
Show all 8 sourcesShow fewer sources
- SocialHacker News
“Supply chain attack on Qubole customers”
- SocialMastodon
“Attackers abused Qubole's trusted AWS access to reach multiple customer accounts between Oct 14-26, stealing stored secrets and data.”
- SocialMastodon
“AWS accounts accessed via hacked Qubole account”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Qubole breach
Was Qubole breached?
The Hacker News reports it. No statement from Qubole has reached cve.now yet.
What data was exposed?
Tokens and keys.
What should Qubole customers do?
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Rotate secrets and credentials stored in AWS accounts connected to Qubole. Review AWS CloudTrail logs for activity between October 14 and October 26. Revoke and audit cross-account roles and access granted to Qubole. Check with Qubole or Idera for confirmation of whether your account was affected.