SaaS integration breach exposed tokens used in attacks on Snowflake customers
Summary
A SaaS integrator breach exposed tokens used in attacks on more than a dozen companies, mostly Snowflake customers. Snowflake locked potentially affected accounts; ShinyHunters claims data theft and extortion, while Anodot’s role remains alleged.
Key points
- A breach at a SaaS integration provider exposed authentication tokens used to target cloud and SaaS services.
- Most reported data-theft attacks targeted Snowflake customer accounts. Snowflake confirmed unusual activity in a small number of accounts and locked potentially affected accounts.
- Snowflake said its systems were not compromised and the attacks did not involve a vulnerability in Snowflake.
- Sources cited by BleepingComputer linked the incident to Anodot; the connection remains alleged.
- ShinyHunters claimed responsibility, said it stole data from dozens of companies, and demanded ransom to prevent its release; those claims were not independently confirmed in the article.
- The group said an attempt to access Salesforce data was blocked by AI detection.
- Payoneer said it was aware of the third-party provider incident but was not impacted; Google Threat Intelligence Group said it was tracking the incident.
Article Details
- Victim Organization
- Anodot is alleged to be the source of the integrator breach; unnamed companies, including a small number of Snowflake customer accounts, were affected by downstream attacks.
- Incident Type
- Alleged breach of a SaaS integration provider exposed authentication tokens, which were reportedly used in data-theft attacks against customer cloud services.
- Data Types Exposed
- Authentication tokens
- Company data (specific types not disclosed)
- Affected Records
- Not disclosed. Snowflake reported unusual activity in a small number of customer accounts; ShinyHunters claimed data theft from dozens of companies.
- Affected Data Size
- Not disclosed
- Operational Impact
- Snowflake locked potentially impacted customer accounts and notified customers. An attempted theft of Salesforce data was reportedly blocked by AI detection. Payoneer stated it was not impacted.
- Ransom Or Extortion
- ShinyHunters claimed responsibility and reportedly demanded ransom payments to prevent release of allegedly stolen data.
- Claim Status
- claimed
MITRE ATT&CK
Threat Actors
Vendors
AnodotMost attacks targeted Snowflake customer accounts while the ShinyHunters extortion group claims responsibility and is demanding ransoms after allegedly exploiting an Anodot incident.SalesforceAttackers attempted to access Salesforce data but were blocked by AI detection, and Google Threat Intelligence is tracking the campaign.SnowflakeMost attacks targeted Snowflake customer accounts while the ShinyHunters extortion group claims responsibility and is demanding ransoms after allegedly exploiting an Anodot incident.
Products
SalesforceAttackers attempted to access Salesforce data but were blocked by AI detection, and Google Threat Intelligence is tracking the campaign.SnowflakeMost attacks targeted Snowflake customer accounts while the ShinyHunters extortion group claims responsibility and is demanding ransoms after allegedly exploiting an Anodot incident.