# SZB-e0d31900bd: Wiz says attacker breached multiple Qubole customers' AWS accounts

Wiz said an attacker accessed AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data.

- Type: Breach
- Status: Reported, not confirmed
- Vendor: Qubole
- Product: AWS IAM
- Disclosed: 2026-11-09 17:51 UTC
- Data taken: Tokens and keys
- Sources: 8 distinct
- First seen by cve.now: 2026-11-09 18:00 UTC · Updated: 2026-11-09 21:30 UTC

> No statement or filing from Qubole has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers, and how those credentials were obtained has not been disclosed.

## What to do

- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys
- Rotate secrets and credentials stored in AWS accounts connected to Qubole
- Review AWS CloudTrail logs for activity between October 14 and October 26
- Revoke and audit cross-account roles and access granted to Qubole
- Check with Qubole or Idera for confirmation of whether your account was affected

## Timeline

- 2026-11-09 17:51 UTC: Made public by The Hacker News
- 2026-11-09 18:00 UTC: First seen by cve.now
- 2026-11-09 18:03 UTC: [Posted on X by cve.now](https://x.com/i/status/2119853427408728543)

## What was taken

- Tokens and keys: [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html): “It read environment variables for Lambda functions, pulled secrets from Secrets Manager, and read values from the SSM Parameter Store.”

## Evidence (8 sources)

- 2026-11-09 · Press · [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html): “An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.”
- 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/thedailytechfeed.com/post/3mzviuzcjfm2g): “Qubole IAM role exploit let attackers leak secrets & data via AWS trust policy abuse.”
- 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mzvjqwlh4c2y): “A malicious campaign targeted cloud environments connected to the data lake platform Qubole between October 14 and October 26.”
- 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/montxt.bsky.social/post/3mzvln3lhct2y): “Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data” (+1 more: [Bluesky](https://bsky.app/profile/newssecia.bsky.social/post/3mzvtyyzodr2x))
- 2026-11-09 · Social · [Mastodon](https://mastodon.social/@Analyst207/117587997318993671): “The intruder exploited Qubole's own AWS credentials to gain unauthorized access to customer environments.”
- 2026-11-09 · Social · [Hacker News](https://news.ycombinator.com/item?id=50432147): “Supply chain attack on Qubole customers”
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@cloud/117588561154496512): “Attackers abused Qubole's trusted AWS access to reach multiple customer accounts between Oct 14-26, stealing stored secrets and data.”
- 2026-11-09 · Social · [Mastodon](https://programming.dev/post/59176133): “AWS accounts accessed via hacked Qubole account”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-e0d31900bd&body=https%3A%2F%2Fcve.now%2FSZB-e0d31900bd%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Qubole breach

### Was Qubole breached?

The Hacker News reports it. No statement from Qubole has reached cve.now yet.

### What data was exposed?

Tokens and keys.

### What should Qubole customers do?

Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Rotate secrets and credentials stored in AWS accounts connected to Qubole. Review AWS CloudTrail logs for activity between October 14 and October 26. Revoke and audit cross-account roles and access granted to Qubole. Check with Qubole or Idera for confirmation of whether your account was affected.

## Related

- Started as early warning SZB-e0d31900bd, first seen 2026-11-09 18:00 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-e0d31900bd
Site guide for agents: https://cve.now/llms.txt