Loading story…
A broad intrusion campaign compromised Snowflake customer environments including Ticketmaster, Santander and AT&T after attackers used credentials stolen by infostealer malware or bought on criminal forums, rather than exploiting a flaw in Snowflake itself. Reporting tied the activity to ShinyHunters, which advertised allegedly stolen data from Ticketmaster and Santander, while Mandiant said many affected accounts lacked multifactor authentication and that more than 100 customer environments were targeted. AT&T said the attackers accessed its Snowflake environment in April and stole call and text metadata for nearly 110 million customers, including numbers contacted, interaction counts and aggregate call durations, but not message content.
The campaign evolved from data theft into extortion, with victims receiving ransom demands and law enforcement pursuing suspects tied to the operation. Canadian authorities arrested a man from Kitchener, Ontario, in connection with the Snowflake hacking and extortion scheme, and reporting later indicated another suspected participant may have been a U.S. soldier. Government agencies including Australia’s Signals Directorate and U.S. investigators were drawn into the response, and AT&T said disclosure of its breach was temporarily delayed at the request of the FBI and DOJ because of national security and public safety concerns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
BlackFog's account of the Snowflake campaign lists Neiman Marcus among the publicly identified organizations affected by the customer-environment compromises. This adds a new named victim beyond those already captured in the existing timeline.
CBC reported that the Kitchener, Ontario man arrested over the Snowflake hacking scheme could face extradition to the United States. The development showed the case progressing beyond arrest toward potential prosecution.
Further reporting identified another alleged participant in the Snowflake extortion activity and said the suspect may be a U.S. soldier. This expanded public attribution around the people allegedly involved in the campaign.
A Canadian man was arrested in connection with the Snowflake data extortion campaign. The arrest represented a significant law enforcement action in the investigation into the breaches and related extortion attempts.
Reporting indicated that a hacker tied to the Snowflake customer data breaches was still active months after the initial disclosures. This marked a continuing operational threat beyond the first wave of victim notifications.
WIRED reported that AT&T paid a hacker about $370,000 in cryptocurrency in an effort to secure deletion of data stolen from its Snowflake environment. The payment marked a specific post-breach extortion response by AT&T beyond its earlier public disclosure of the incident.
AT&T disclosed that a cyberattack against its Snowflake environment exposed call and text metadata for roughly 110 million customers. The stolen records covered a six-month period ending October 31, 2022, plus records from January 2, 2023, but not message contents or customer names.
Mandiant reported that the Snowflake intrusions were driven by stolen credentials harvested from non-Snowflake systems and that affected accounts generally lacked multifactor authentication. Reporting said more than 165 Snowflake customers did not use MFA, underscoring the campaign's scale and cause.
Pure Storage confirmed that attackers accessed data through a compromised Snowflake account, making it another publicly identified victim in the broader Snowflake customer compromise campaign. The disclosure added a new affected organization beyond those already named publicly.
Reporting said victims of the Snowflake data breach campaign were receiving ransom demands. This reflected a later-stage monetization and extortion phase affecting organizations compromised in the earlier intrusions.
WIRED reported that Advanced Auto Parts and LendingTree were among the organizations affected in the Snowflake customer compromise campaign. The report expanded the known victim list beyond Santander and Ticketmaster, indicating the breach wave was broader than initially disclosed.
Australia's Signals Directorate said it was aware of successful compromises involving several companies using Snowflake environments. This added government confirmation that the activity extended beyond the initially named victims.
Snowflake disclosed that accounts belonging to multiple customers were compromised after threat actors used credentials obtained via infostealer malware or bought on cybercrime forums. The company said the activity was not due to a vulnerability in Snowflake's platform itself.
Ticketmaster parent Live Nation confirmed a recently disclosed breach and identified Snowflake as the third-party cloud provider involved. The incident was publicly linked to the same campaign affecting other Snowflake customers.
Santander disclosed that data belonging to millions of customers and all current and some former employees had been hacked. Reporting linked the incident to compromises of Snowflake customer environments.
AT&T said it discovered the theft on April 19, 2024, and began incident response with third-party cybersecurity experts. Subsequent public disclosure was delayed after FBI and DOJ requests tied to national security and public safety concerns.
AT&T said attackers accessed its Snowflake environment between April 14 and April 25, 2024, as part of the broader Snowflake customer compromise campaign. The intrusion led to theft of call and text metadata affecting nearly all of AT&T's wireless customers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
22 references tracked. Mallory keeps watching after this page renders.
blackfog.com
Open sourcebankinfosecurity.com
Open sourcecbc.ca
Open sourcekrebsonsecurity.com
Open sourcebbc.com
Open sourcetheverge.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026
A breach at a third-party SaaS integration provider allegedly exposed authentication tokens that were then used to steal data from more than a dozen companies, with most of the activity targeting **Snowflake** customer environments. Snowflake said it detected unusual activity affecting a small number of customers tied to a specific third-party integration and emphasized that its own platform was not compromised through a vulnerability. Reporting identified the suspected source as **Anodot**, a data anomaly detection company owned by Glassbox, though neither company publicly responded at the time. The threat actor identified as **ShinyHunters** claimed responsibility, saying it stole data from dozens of organizations and sought extortion payments to prevent publication of the information. The campaign reportedly also targeted other cloud and SaaS providers, while an attempted theft involving **Salesforce** was said to have been blocked by AI-based detection. **Google Threat Intelligence Group** said it was tracking the incident, and **Payoneer** said it was aware of the provider breach linked to Anodot but had determined it was not affected.
Jun 29, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026