Snowflake Breaches 2024: Ticketmaster, AT&T, Santander Hit via Customer-Side Credentials

Incident summary

Snowflake is the cloud data warehouse used by thousands of enterprises to centralize analytics data. Tenants typically hold customer records, billing data, telemetry, and partner data, often the most sensitive structured data an organization owns. In 2024, threat group UNC5537 (Mandiant designation) ran a credential-replay campaign against Snowflake customer tenants. Per Mandiant's June 10, 2024 advisory, the campaign reached at least 165 customer tenants between May and August 2024 and produced public breach disclosures from Ticketmaster, AT&T, Santander, Advance Auto Parts, Pure Storage, Neiman Marcus, Lending Tree, Anheuser-Busch, and others.

The root cause was not a Snowflake platform vulnerability. Per Snowflake CISO Brad Jones' joint statement with Mandiant and CrowdStrike on June 2, 2024, the threat actor used valid customer credentials obtained from infostealer malware logs (LUMMA, RACOON, REDLINE, VIDAR) on contractor and developer endpoints, some dating to 2020. The compromised Snowflake user accounts did not have multi-factor authentication enforced. Snowflake's authentication model at the time defaulted to single-factor and required tenant admins to opt in to MFA.

Ticketmaster's parent company Live Nation disclosed in a May 31, 2024 SEC Form 8-K that approximately 560 million customer records were exfiltrated. AT&T disclosed on July 12, 2024 that call detail records for nearly all wireless customers between May 2022 and October 2022 plus a portion of January 2023 had been exfiltrated. Per Wired's July 14 reporting, AT&T paid the threat actor approximately $370,000 in Bitcoin to delete the stolen data.

Attack technique

MITRE ATT&CK maps the campaign primarily to T1078.004 (Valid Accounts: Cloud Accounts), with T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) and T1539 (Steal Web Session Cookie) covering the upstream infostealer collection, and T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage) covering the bulk-unload behavior. The technique chain is straightforward: harvest credentials from victim endpoints via commodity infostealer malware, identify Snowflake URLs in the harvested credential logs, attempt login at scale against tenants without MFA, and exfiltrate data via Snowflake's own COPY INTO command to attacker-controlled S3 buckets.

Per Mandiant, UNC5537 used a custom utility variously named rapeflake or FROSTBITE for Snowflake-specific reconnaissance. The utility enumerated databases, schemas, and tables, queried row counts to identify high-value targets, and staged the COPY INTO commands. The actor staged exfiltration to external S3 buckets via Snowflake's own data unloading mechanism, which made the egress look like a normal Snowflake operation from the platform's perspective.

Infostealer marketplaces are the structural enabler. Per multiple Mandiant and CrowdStrike reports, credentials harvested by LUMMA, RACOON, REDLINE, and VIDAR are sold in bulk on Telegram channels and Russian-language forums for $10 to $100 per log depending on the targeted victim. The Snowflake campaign demonstrates how a non-glamorous commodity malware marketplace produces nation-state-grade outcomes when combined with SaaS tenants that do not enforce MFA. The campaign produced no zero-day, no novel malware, no advanced TTPs — only credential reuse against unenforced controls.

Snowflake responded operationally with the June 7, 2024 release of a network policy feature that lets tenant admins enforce IP allowlisting for user authentication and the July 17, 2024 announcement of mandatory MFA for human user accounts in new Snowflake editions. Snowflake also enabled tenant-level alerts for anomalous data egress and improved its CISO portal incident communications. Snowflake's stock traded down approximately 6 percent on June 3, 2024 after the initial customer notifications became public.

Impact and consequences

The Ticketmaster breach is the largest publicly disclosed by record count. Per Live Nation's May 31, 2024 SEC Form 8-K and follow-up notifications, approximately 560 million customer records were exfiltrated, including names, addresses, email addresses, partial payment card data, and order history. ShinyHunters posted the dataset for sale at $500,000 on BreachForums on May 27, 2024. Multiple class-action lawsuits followed in US federal court.

AT&T's disclosure was the most operationally damaging by data sensitivity. Per the July 12, 2024 8-K, the breach exposed call detail records (CDRs) including the phone numbers called and call duration for nearly all AT&T wireless customers during the affected window. The records did not include call content or SMS message text. Wired reported on July 14, 2024 that AT&T paid the threat actor approximately $370,000 in Bitcoin to delete the stolen data, a payment routed through ShinyHunters intermediary John Erin Binns. The FBI was involved in the negotiation.

Santander's May 14, 2024 disclosure covered approximately 30 million customers and employees in Spain, Chile, and Uruguay. Advance Auto Parts disclosed approximately 2.3 million current and former employee records affected. Pure Storage confirmed the compromise of a workspace within its Snowflake tenant but reported that the affected workspace contained only telemetry, not customer data. Neiman Marcus disclosed approximately 31 million customer records affected.

The regulatory consequences for Snowflake itself were limited because the root cause was customer-side credential hygiene, not a Snowflake platform vulnerability. The reputational consequence was more meaningful. Snowflake's shared-responsibility position — that customers are responsible for their own credential hygiene and MFA enforcement — was widely critiqued in trade press as failing the test of secure defaults. Snowflake's commitment to mandatory MFA for new tenants in July 2024 was a direct response to that critique. The campaign also accelerated Salesforce, Microsoft, and Workday efforts to flip their authentication defaults from opt-in MFA to default-on MFA across their respective platforms through late 2024 and into 2025.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Treat shared-responsibility lines on SaaS platforms as defaults you have to override. Snowflake's pre-July 2024 default was single-factor authentication unless the tenant admin enabled MFA. That default produced the breach. Every SaaS platform you depend on has a similar set of opt-in security controls. Audit them. Enable MFA, IP allowlisting, session timeouts, and anomaly alerting on every tenant. Document those settings in your tenant baseline configuration the same way you document Active Directory baselines.

Infostealer logs are now a tier-one threat intelligence source. Mature security teams subscribe to infostealer log monitoring services that match your domains and email addresses against credentials posted on Telegram and Russian-language forums. If your domains appear in fresh logs, treat it as a credential compromise on the listed user and force a password reset plus MFA re-enrollment immediately, regardless of whether the user has logged in from the suspicious endpoint.

Endpoint controls on contractor and developer machines determine your SaaS perimeter. Per Mandiant, several of the compromised Snowflake credentials originated on contractor or personal endpoints that were not managed by the victim organization's EDR. Bring-your-own-device or unmanaged contractor laptop access to high-value SaaS tenants is the structural risk. Enforce managed-device-only access to sensitive SaaS through conditional access policies tied to device posture, or terminate the access path.

Egress controls on data warehouses are a primary control, not a secondary one. The UNC5537 campaign used Snowflake's own COPY INTO command to exfiltrate data to attacker-controlled S3 buckets. Tenant-level controls that restrict data unloading to specific allowlisted external stages defeat that exfiltration path. Configure those controls before you need them. Snowflake's network policy and external stage allowlist are the specific features to enable.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/incident-responder
• /careers/security-architect
• /careers/iam-engineer

Related Decipher Files

• Snowflake UNC5537: How Stolen Infostealer Credentials Drained 165 Customer Tenants
• Okta Support Breach 2023: 1Password, Cloudflare, BeyondTrust Timeline

Frequently asked questions