An attacker used credentials from an AWS account associated with data platform Qubole to enter customers’ cloud accounts. Wiz’s investigation, conducted with Sentra and Mandiant, traces successful access between October 14 and 26. Customers had granted the vendor cross-account roles, which let an outside AWS account temporarily assume permissions inside theirs. Some roles had sat unused for months but still trusted the vendor account.

Evidence status: researchers report observed intrusions and S3 data downloads, not a simulated exploit. Sentra says it saw activity across affected customers and reported it to Wiz. Wiz ties sessions to two identities in Qubole’s account, then describes secret retrieval and object downloads in customer accounts. Bill Toulas’s report says Qubole had not issued a public statement when he asked. The researchers sell cloud-security products; the initial theft of Qubole credentials has not been publicly explained.

Which accounts are exposed

This matters to organizations with an AWS role that still trusts Qubole’s account, even if they no longer use the integration. The attacker supplied the expected external identifier, a second value used when assuming a third-party role. It did not help because the vendor-side credentials were already available to the attacker. What each session could reach depended on that customer’s role permissions.

Wiz reports access to secrets in Secrets Manager, Parameter Store and Lambda settings. It also describes S3 object downloads and attempts to validate additional credentials. Sentra says it found activity affecting dozens of Qubole customers, but gives no independently audited global victim total. Wiz found a separate malicious disk image on related infrastructure and could not confirm it was deployed; that artifact is not evidence of another intrusion here.

Check dormant trust and data reads

  • Inventory roles that trust the Qubole account and remove unused integrations. For roles still needed, narrow both their trust conditions and the data they can read.
  • For Qubole-linked accounts, Wiz recommends reviewing CloudTrail from October 1 onward. Look for unusual role assumptions, then investigate the resulting sessions’ secrets and storage access. A VPN address alone is not proof; correlate identities, session activity and timing.
  • Check whether S3 data-event logging or bucket access logs were enabled. Management events show role assumption and bucket discovery, but usually cannot establish which objects were read. Sentra used available file-read and decryption records to narrow exposure for particular customers.
  • If a suspect session had access to secrets, rotate the credentials it could read and revoke active role sessions. Replacing a secret alone does not end temporary sessions already issued. Preserve logs needed to investigate what was downloaded.

Caveat: Wiz and Sentra report observed incidents in their investigation; they have not established how the vendor credentials were initially taken or published a complete cross-customer impact count.