Wiz Reports Attackers Abused Qubole’s AWS Access to Steal Customer Secrets and Data
Summary
Wiz says attackers used Qubole’s trusted AWS access to retrieve customer secrets and copy S3 data between October 14 and 26. It also describes separate access-key activity from October 8 to 11 that has not been linked to the first attack.
Key points
- Wiz reported that attackers used credentials for an AWS account operated by Qubole to assume customer IAM roles between October 14 and 26; how the credentials were obtained is unknown.
- The attackers searched Lambda environment variables, Secrets Manager, and SSM Parameter Store for credentials, then tested discovered credentials with TruffleHog.
- Wiz says attackers copied data from accessible S3 buckets, sometimes downloading an entire bucket in one session.
- Organizations with current or former Qubole AWS roles should review CloudTrail logs from October 1 for AssumeRole requests from account 805246085872 originating outside AWS.
- CloudTrail management events do not show which S3 objects were read; S3 data events or server access logs are needed, and some examined victims lacked those logs.
- A separate October 8–11 incident involved customers’ own AWS access keys and compromised some cloud environments; researchers believe the keys were configured for Qubole but have not linked this activity to the AssumeRole abuse.
- The researchers did not say whether the credentials were disabled or the activity had stopped; Qubole and Idera had not posted statements when the article was published.
Article Details
- Victim Organization
- Multiple Qubole customers
- Incident Type
- Compromise of customer AWS environments through abuse of Qubole-trusted access, followed by credential and S3 data theft
- Incident Date
- 2026-10-14
- Data Types Exposed
- Stored credentials and secrets, including AWS access keys, Entra ID client secrets, and Okta client credentials
- Data stored in S3 buckets
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- The attacker accessed multiple customers' AWS accounts, searched for stored credentials, and copied data from accessible S3 buckets. Some victims lacked logging needed to determine which S3 objects were read. Wiz said the activity occurred from October 14 to October 26; a separate October 8–11 incident involving customers' own AWS access keys was not linked to this activity.
- Ransom Or Extortion
- Unknown
- Claim Status
- claimed
MITRE ATT&CK
Vendors
Amazon Web ServicesAn attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.QuboleAn attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.
Products
AWS LambdaIn the accounts the researchers examined, the attacker looked for stored credentials. It read environment variables for Lambda functions, pulled secrets from Secrets Manager, and read values from the SSM Parameter Store.CloudTrailAny organization that has connected Qubole to AWS, even one that no longer uses it, should check its CloudTrail logs from October 1 onward. The sign to look for is an AssumeRole request from the account Qubole'sEntra IDIt then ran the credentials it had found through TruffleHog to test whether they worked. These were the victims' own AWS access keys, Entra ID client secrets, and Okta client credentials.OktaIt then ran the credentials it had found through TruffleHog to test whether they worked. These were the victims' own AWS access keys, Entra ID client secrets, and Okta client credentials.QuboleAn attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.S3The attacker also copied data out of S3. It retrieved data from any bucket a role could access rather than searching for specific data, and sometimes downloaded an entire bucket in a single session.Secrets ManagerIn the accounts the researchers examined, the attacker looked for stored credentials. It read environment variables for Lambda functions, pulled secrets from Secrets Manager, and read values from the SSM Parameter Store.SSM Parameter StoreIn the accounts the researchers examined, the attacker looked for stored credentials. It read environment variables for Lambda functions, pulled secrets from Secrets Manager, and read values from the SSM Parameter Store.