Hackers Exploit Qubole’s Trusted AWS Access to Breach Customer Accounts and Steal Data

An attacker used credentials for the AWS account that Qubole’s data platform uses to reach its customers to break into multiple customers' AWS accounts between October 14 and 26 and steal stored secrets and data, according to Wiz. The attacker abused IAM roles that trusted Qubole’s account, read secrets from Secrets Manager, SSM Parameter Store and Lambda environment variables, and copied data from S3 buckets; any organisation that has connected Qubole to AWS is urged to check CloudTrail logs from October 1 onward.