Attacker in 2024 Snowflake Breach Pleads Guilty

Executive Summary

On August 6, 2026, a significant legal development was confirmed in the investigation into the massive 2024 Snowflake customer data breaches. The primary individual behind the attacks has pleaded guilty in a U.S. federal court. The campaign targeted numerous Snowflake customer tenants using valid, but previously compromised, credentials. The core security failure enabling these breaches was the absence of multi-factor authentication (MFA) on the targeted accounts. This allowed the attacker to gain unauthorized access and exfiltrate over 100 million records across multiple organizations, highlighting the critical importance of implementing MFA on all privileged and data-access accounts, especially in cloud environments.

Threat Overview

The series of attacks, which took place throughout 2024, did not exploit a vulnerability in Snowflake's platform itself. Instead, the threat actor leveraged a large collection of credentials stolen from other sources, such as infostealer malware logs, to launch a widespread credential stuffing campaign against Snowflake customer accounts. The attacker systematically tested these credentials and successfully breached tenants where the accounts were not protected by MFA. Once inside, the actor had access to the data stored within the customer's Snowflake environment, leading to the theft of more than 100 million records.

Technical Analysis

The attacker's methodology was straightforward but highly effective due to poor security hygiene on the victim's part. The primary technique was credential stuffing, a subset of brute-force attacks.

1. Credential Acquisition: The attacker obtained large volumes of usernames and passwords from underground markets, likely sourced from infostealer malware infections on employee devices.
2. Account Access: The attacker used automated tools to test these credentials against Snowflake login endpoints.
3. Bypass of Controls: The attacks succeeded only on accounts where single-factor authentication (username and password) was the sole security measure. Accounts with MFA enabled were resilient to this attack.
4. Data Exfiltration: Upon gaining access, the attacker navigated the Snowflake environment and exfiltrated sensitive data.

MITRE ATT&CK Mapping

• T1078.004 - Valid Accounts: Cloud Accounts: This is the primary technique used. The attacker logged in with legitimate, albeit stolen, user credentials to gain access to the cloud environment.
• T1530 - Data from Cloud Storage Object: After gaining access, the attacker exfiltrated data stored within the Snowflake data cloud.

Impact Assessment

The impact of this campaign was substantial for the affected Snowflake customers. The exposure of over 100 million records likely included sensitive customer data, intellectual property, and internal business information, leading to significant regulatory fines (e.g., under GDPR or CCPA), reputational damage, and financial losses. Victims incurred high costs related to incident response, forensic investigations, customer notifications, and credit monitoring services. The incident serves as a stark reminder that the security of data in the cloud is a shared responsibility, and customers must implement fundamental security controls like MFA to protect their environments.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were mentioned in the source articles.

Cyber Observables — Hunting Hints

The following patterns could indicate related activity against cloud data platforms:

Detection & Response

1. Impossible Travel Alerts: Implement and monitor for "impossible travel" alerts, which trigger when an account logs in from geographically distant locations in a short period. This is a key capability of D3-UGLPA: User Geolocation Logon Pattern Analysis.
2. Login Anomaly Detection: Use User and Entity Behavior Analytics (UEBA) tools to baseline normal login behavior and alert on deviations, such as logins from new devices, at unusual times, or from suspicious IP ranges.
3. Data Access Monitoring: Monitor for anomalous data access patterns. An account that suddenly queries or downloads vast amounts of data is a major red flag.
4. Audit Log Review: Regularly audit Snowflake access logs (LOGIN_HISTORY, QUERY_HISTORY) for signs of unauthorized access or suspicious activity.

Mitigation

1. Enforce MFA: The single most effective mitigation is to mandate the use of Multi-factor Authentication (MFA) for all users, especially those with access to sensitive data. This corresponds to MITRE Mitigation M1032.
2. Network Policies: Use Snowflake's network policy features to restrict access to a specific set of trusted IP addresses (e.g., corporate VPN or office IPs). This is a form of MITRE Mitigation M1035: Limit Access to Resource Over Network.
3. Credential Hygiene: Proactively monitor for corporate credential leaks on the dark web and force password resets for affected users.
4. Privileged Account Management: Implement the principle of least privilege. User accounts should only have access to the data they absolutely need to perform their job functions. This aligns with MITRE Mitigation M1026.