AI-generated infographic: stolen qubole credentials used in customer aws accounts. Its figures are taken from this article. Infographic: Grok.
By news editor
An attacker who obtained credentials belonging to Qubole, a big-data analytics platform, spent nearly two weeks in October entering the Amazon Web Services accounts of companies that had once granted Qubole access, reading stored passwords and downloading files, according to the security companies Wiz and Sentra. Amazon Web Services says its own services were not compromised.
Wiz says it observed the activity between October 14 and October 26, 2026, working with Sentra and Mandiant. The attacker used two identity and access management (IAM) users in an AWS account associated with Qubole to assume roles that customers had created for the vendor. A cross-account role of this kind is a standing permission that lets a supplier's AWS account act inside a customer's account.
Neither report names a victim. Sentra, which says it spotted the campaign in its own customers' environments and reported it to Wiz, writes: "Dozens of Qubole customers were impacted." A summary in the same post puts the figure at more than a dozen organizations. Wiz gives no count.
Many of the roles were leftovers. Wiz reports that most of the roles the attacker assumed were not otherwise in use, and that in a majority of the environments it examined the attacker's requests were the only role activity from the vendor account in October. Sentra says Qubole roles were still in place long after companies had stopped using the product, which puts former customers in the affected group alongside current ones.
The usual safeguard did not stop the intrusions. Integrations like this are typically gated by an External ID, a code the vendor presents when it asks for access. Wiz's finding on that control: "Every AssumeRole request we attributed to the threat actor included an External ID, and every one succeeded." Sentra's account is shorter: "As far as AWS could tell, the attacker was Qubole."
Once inside, the attacker read credentials held in AWS Secrets Manager, the SSM Parameter Store and Lambda function settings, then tested the AWS, Entra ID and Okta credentials it found there, Wiz says. It also downloaded data from S3 storage, in some cases entire buckets in a single session. Sentra counts about 100 passwords and keys read in 7 minutes, and says file access logs across one company's accounts recorded millions of files downloaded. Sentra's tally also shows 0 write actions: nothing was changed or deleted.
No dollar figure for the damage appears in either report. The work that falls on affected companies is spelled out instead. Wiz tells any company whose role was assumed to rotate every secret the role could read and revoke its active sessions, and Sentra notes that breach notification deadlines can be as short as 72 hours. In several affected environments, Wiz adds, missing logs meant responders could not see which S3 objects the attacker read.
How the attacker got Qubole's credentials is not disclosed. Wiz's report does not say, and the company states that it has not identified ties between this campaign and other publicly reported activity. It describes the data theft as opportunistic. Wiz also reports a separate set of activity from October 8 to October 11 that used customer-owned access keys it believes were created for Qubole integrations, and says it has not been able to link the two.
Qubole has not commented publicly, as far as BleepingComputer could establish: the outlet reports that it found no public announcement from the company and has emailed it for more information. An AWS spokesperson told BleepingComputer: "AWS services were not compromised by this issue and operated as designed." The statement recommends that customers regularly review cross-account roles, remove access for integrations no longer in use, grant least-privilege permissions and add conditions such as source IP restrictions to role trust policies.
Wiz's assessment of that last control is specific: "In this activity, a source IP condition alone would have blocked every role assumption we observed."
The next thing to watch is whether Qubole says how its credentials were taken and how many customer accounts trusted the affected AWS account, and whether any of the affected companies disclose the breach themselves. Wiz advises every organization that has integrated with Qubole to review its CloudTrail logs from October 1, 2026 onward.
Leave a Reply