how it happened
- whoUNC5537infostealer passwords
- the gapno MFApassword was the only check
- thencustomer tenantsdata copied and extorted
- the result~165 organisationsnotified by Mandiant
what everyone assumed
Old leaks feel like history: the laptop was reimaged, the employee may have left, the breach announcement was three news cycles ago. A credential that old has surely expired or been changed by now, the reasoning goes. Nobody schedules work around passwords stolen years ago.
what happened
The credentials stayed valid because nothing forced them not to be. The data-platform tenants they opened had no second factor enforced, so a username and password from an ancient infostealer log was the entire entry requirement. The logins, when they came, looked like logins.
step by step
- old infostealer logs hold Snowflake passwordsThey were never rotated.
- tenants have no MFA enforcedA username and password is the whole entry requirement.the assumption breaks here
- 2024the logins look like loginsData is taken from tenant after tenant.
- about 165 organisations notifiedNo platform vulnerability involved.
how it surfaced
Through 2024 the wave rolled across major Snowflake customers, with Mandiant notifying about 165 potentially exposed organisations, becoming one of the largest data-theft clusters of the year. No platform vulnerability was involved; the post-mortems read simply: valid credentials, missing MFA.
A leaked credential does not age out.
It stays live until a rotation or a second factor makes it worthless, and neither happens by default.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersSomeone logs in with that old password and downloads everything.what it costs youThere was no break-in to detect. It looked like a normal login.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedChange Healthcare, 2024howA stolen password gets through the one remote-access door without a code.what leavescontrol of the systems customers rely onwho ends up with ita ransomware crew
sources
your turn
what you can do about it
this week
List the systems that still accept a username and password alone.
Somewhere in your stack is a system that still accepts a username and a password alone, and somewhere in a criminal dataset is a password one of your people used years ago. The pairing of those two facts is what this wave monetized. The list of systems without enforced MFA is where this story points.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →