A Canadian national has pleaded guilty to orchestrating a massive data extortion campaign targeting Snowflake cloud database customers, compromising over 165 organizations worldwide. The attacker exploited stolen credentials to access sensitive customer data, extorting victims for millions of dollars in cryptocurrency. This case highlights the devastating impact of credential-based attacks and the critical importance of multi-factor authentication in cloud environments.
Introduction
In a significant development for cloud security, Canadian authorities have secured a guilty plea from an individual responsible for one of 2024’s most extensive data extortion campaigns. The perpetrator systematically targeted organizations using Snowflake’s cloud data warehousing platform, leveraging stolen credentials to infiltrate corporate databases containing sensitive customer information.
The campaign affected major corporations across multiple sectors, including telecommunications, healthcare, and financial services, with victims spanning North America, Europe, and beyond. The extortion scheme netted millions in cryptocurrency payments while exposing billions of customer records to potential compromise.
This case represents a watershed moment for cloud security, demonstrating how a single threat actor exploiting weak authentication practices can create cascading damage across an entire ecosystem of enterprise customers.
Background & Context
Snowflake operates as a cloud-based data warehousing platform, allowing organizations to store, process, and analyze massive datasets. The platform has become increasingly popular among Fortune 500 companies for its scalability and performance capabilities.
The extortion campaign began emerging in April 2024 when several Snowflake customers reported unauthorized access to their database instances. Initial investigations revealed a pattern: attackers were using legitimate credentials rather than exploiting software vulnerabilities. This credential-based approach allowed the threat actor to blend in with normal user activity, delaying detection.
The attacker’s methodology involved purchasing stolen credentials from underground marketplaces, specifically targeting accounts lacking multi-factor authentication (MFA) protection. Many of these credentials had been harvested through previous infostealer malware campaigns, creating a supply chain of compromised access that fed directly into this extortion operation.
High-profile victims included major telecommunications providers, ticketing platforms, and lending institutions. In several cases, customer data including names, addresses, phone numbers, and partial financial information was exfiltrated and used as leverage for extortion demands.
Technical Breakdown
The attack chain followed a methodical pattern that prioritized stealth and persistence:
Initial Access: The attacker acquired valid Snowflake customer credentials from criminal marketplaces. These credentials originated from infostealer malware infections on corporate devices, particularly targeting employees with database administrative access.
Authentication Exploitation: The perpetrator specifically targeted accounts without MFA enabled. Snowflake did not enforce MFA by default during the affected period, creating a significant security gap that allowed credential-based access to succeed.
Reconnaissance: Once inside, the attacker conducted systematic database enumeration to identify high-value data repositories:
SHOW DATABASES;
SHOW SCHEMAS IN DATABASE ;
SHOW TABLES IN SCHEMA ;
SELECT COUNT(*) FROM ; Data Exfiltration: The attacker used Snowflake’s native data export functionality to extract sensitive information:
COPY INTO @external_stage/exfil_data
FROM
FILE_FORMAT = (TYPE = 'CSV' COMPRESSION = 'GZIP'); Persistence Mechanisms: To maintain access, the attacker created additional user accounts and modified existing permissions:
CREATE USER backup_access PASSWORD='';
GRANT ROLE ACCOUNTADMIN TO USER backup_access; Extortion Demands: Victims received communications threatening to publish stolen data unless cryptocurrency payments were made to specified wallet addresses. Payment demands ranged from hundreds of thousands to millions of dollars depending on the organization’s size and data sensitivity.
The attacker demonstrated sophisticated operational security, using VPNs and compromised infrastructure to obscure their location and identity throughout the campaign.
Impact & Risk Assessment
The breach’s impact extends far beyond the immediate victims, creating several risk categories:
Direct Financial Impact: Organizations faced multimillion-dollar extortion demands, incident response costs, regulatory fines, and customer notification expenses. Some victims reportedly paid ransoms, though exact figures remain undisclosed.
Customer Privacy Violations: Billions of customer records were potentially compromised, including personally identifiable information (PII), financial data, and behavioral analytics. Affected individuals face increased risks of identity theft, phishing attacks, and social engineering.
Reputational Damage: Publicly disclosed victims experienced stock price volatility and customer trust erosion. The incident raised questions about organizational security practices and vendor due diligence.
Regulatory Consequences: Multiple victims face investigations from data protection authorities under GDPR, CCPA, and other privacy frameworks. Penalties could reach tens of millions of dollars for organizations deemed to have inadequate security controls.
Supply Chain Implications: The incident demonstrated how cloud platform security configurations affect entire customer ecosystems. Organizations now face increased scrutiny regarding their cloud security posture and third-party risk management.
The severity is amplified by the attack’s simplicity—no zero-day exploits or sophisticated malware were required, only stolen credentials and the absence of MFA.
Vendor Response
Snowflake responded to the incident with several immediate and long-term measures:
The company issued security advisories urging customers to enable MFA and implement network policies restricting access by IP address. Snowflake emphasized that the incidents resulted from customer credential compromises rather than platform vulnerabilities.
The vendor deployed enhanced monitoring capabilities to detect anomalous authentication patterns and unusual data export activities. These included behavioral analytics identifying access from unexpected geographic locations or devices.
Snowflake announced plans to mandate MFA for all accounts, moving away from optional security controls to enforced baseline protections. The company also enhanced its default logging capabilities to provide customers with better visibility into access patterns.
The vendor established a dedicated response team to assist affected customers with forensic investigations, credential rotation, and security hardening. Snowflake partnered with third-party cybersecurity firms to conduct comprehensive reviews of the incidents.
However, criticism emerged regarding Snowflake’s initial response timeline and the lack of mandatory MFA implementation prior to the incidents. Security researchers noted that enforced MFA could have prevented the majority of compromises.
Mitigations & Workarounds
Organizations using Snowflake or similar cloud platforms should implement these immediate protections:
Mandatory MFA Enforcement: Enable multi-factor authentication for all user accounts without exception:
ALTER ACCOUNT SET ALLOW_CLIENT_MFA_CACHING = FALSE;
ALTER USER SET MUST_CHANGE_PASSWORD = TRUE; Network Policy Implementation: Restrict database access to known IP ranges:
CREATE NETWORK POLICY corporate_only
ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.0/24')
BLOCKED_IP_LIST = ('0.0.0.0/0');
ALTER ACCOUNT SET NETWORK_POLICY = corporate_only;Credential Rotation: Immediately reset all passwords and rotate service account credentials, especially for administrative accounts.
Session Management: Reduce session timeout values to minimize exposure windows:
ALTER ACCOUNT SET CLIENT_SESSION_KEEP_ALIVE = FALSE;
ALTER ACCOUNT SET CLIENT_SESSION_KEEP_ALIVE_HEARTBEAT_FREQUENCY = 900;Access Reviews: Conduct comprehensive audits of user permissions, removing unnecessary administrative privileges and implementing least-privilege access models.
External Stage Security: Review and restrict external data staging locations to prevent unauthorized exfiltration channels.
Detection & Monitoring
Implementing robust detection capabilities is essential for identifying credential-based attacks:
Authentication Monitoring: Track login patterns for anomalies:
SELECT
USER_NAME,
CLIENT_IP,
REPORTED_CLIENT_TYPE,
ERROR_MESSAGE,
FIRST_AUTHENTICATION_FACTOR,
SECOND_AUTHENTICATION_FACTOR
FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
WHERE IS_SUCCESS = 'NO'
AND EVENT_TIMESTAMP > DATEADD(hour, -24, CURRENT_TIMESTAMP())
ORDER BY EVENT_TIMESTAMP DESC;Data Export Detection: Monitor for unusual data copying activities:
SELECT
USER_NAME,
QUERY_TEXT,
EXECUTION_STATUS,
BYTES_SCANNED,
ROWS_PRODUCED
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE QUERY_TEXT ILIKE '%COPY INTO%'
AND START_TIME > DATEADD(day, -7, CURRENT_TIMESTAMP())
ORDER BY BYTES_SCANNED DESC;Geographic Anomaly Detection: Identify access from unexpected locations by correlating user accounts with typical source IP addresses and flagging deviations.
Privilege Escalation Monitoring: Track changes to user roles and permissions:
SELECT
*
FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS
WHERE DELETED_ON IS NULL
AND CREATED_ON > DATEADD(day, -30, CURRENT_TIMESTAMP())
ORDER BY CREATED_ON DESC;Integrate Snowflake audit logs with SIEM platforms for centralized monitoring and automated alerting on suspicious patterns.
Best Practices
Organizations should adopt these long-term security practices:
Zero Trust Architecture: Implement continuous verification for all access requests, regardless of source. Never assume trust based on network location alone.
Credential Hygiene: Deploy password managers, enforce complex password requirements, and implement regular rotation schedules. Monitor for credentials appearing in breach databases using services like Have I Been Pwned.
Endpoint Protection: Deploy advanced endpoint detection and response (EDR) solutions to prevent infostealer malware from harvesting credentials in the first place.
Security Awareness Training: Educate employees about phishing, credential theft, and social engineering tactics. Emphasize the importance of reporting suspicious activities immediately.
Data Classification: Implement comprehensive data classification schemes to understand what sensitive information resides in cloud databases. Apply appropriate security controls based on data sensitivity.
Incident Response Planning: Develop and regularly test incident response playbooks specifically for cloud platform compromises, including clear escalation procedures and communication protocols.
Third-Party Risk Management: Evaluate cloud vendors’ security capabilities, including default configurations, available security controls, and incident response commitments before deployment.
Privileged Access Management: Implement PAM solutions to control, monitor, and audit administrative access to cloud platforms. Use just-in-time access provisioning where possible.
Key Takeaways
- Credential-based attacks remain highly effective against organizations lacking MFA, regardless of cloud platform security
- The guilty plea demonstrates increasing law enforcement success in attributing and prosecuting cybercriminals operating internationally
- Cloud security is a shared responsibility model—vendors provide tools, but customers must implement appropriate configurations
- Stolen credentials from infostealer malware create persistent risks that extend far beyond initial infections
- Mandatory MFA enforcement could have prevented the vast majority of compromises in this campaign
- Organizations must implement comprehensive monitoring to detect credential misuse before significant data exfiltration occurs
- The incident underscores the critical importance of endpoint security to prevent credential theft at the source
References
- Snowflake Security Advisories and Best Practices Documentation
- ACCOUNT_USAGE Schema Reference for Security Monitoring
- NIST Special Publication 800-63B: Digital Identity Guidelines
- Cloud Security Alliance Cloud Controls Matrix
- MITRE ATT&CK Framework: Valid Accounts (T1078)
- Cybersecurity and Infrastructure Security Agency (CISA) Cloud Security Guidance
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
