Snowflake is a cloud platform that stores and analyzes large company datasets. This prevention guide shows customers how to block account takeovers with enforced MFA, trusted-IP limits, and active monitoring plus fast recovery.
Mandiant reports that financially motivated actor UNC5537 systematically compromised Snowflake customer instances with stolen credentials, then advertised victim data and extorted victims, as described in Mandiant's UNC5537 analysis. Affected accounts lacked multi-factor authentication, so a valid username and password was enough. Mandiant attributes those logins to credentials harvested by infostealer malware, with no Snowflake vulnerability exploited.
Table of Contents
- How attackers broke in
- What was at stake
- Which controls prevent it
- What to watch every day
- How to recover after compromise
How attackers broke in
The method was simple credential abuse at scale. Attackers reused usernames and passwords stolen outside Snowflake. Without MFA, each valid pair opened the account directly.
Mandiant found the operation systematic, not opportunistic. Stolen access led to data theft, forum advertising, and extortion demands. That sequence makes fast lockout and credential reset critical.
What was at stake
TechCrunch reported the campaign hit about 165 customer environments including AT&T, Ticketmaster/Live Nation, Santander and LendingTree, detailed in TechCrunch's case report. AT&T alone lost call and text records for over 100 million customers.
The lesson is scope. One weak login can expose call metadata, financial records, ticket orders, or loan files. Central data storage raises the cost of one reused password.
Which controls prevent it
Snowflake's prevention guidance calls for identity and network limits first, explained in Snowflake's prevention guidance. Apply authentication policies that require MFA for human users.
Restrict logins to trusted IPs with network policies. Snowflake Documentation says single-factor password logins are being phased out from September 2025 through October 2026. Plan now: move people to MFA and move services off passwords.
- Require MFA for all Snowsight and password users.
- Use SSO, key-pair, OAuth, PAT, or workload identity for service accounts.
- Block logins outside approved IP ranges and geographies.
- Rotate stale passwords and remove inactive users.
- Separate human logins from automated service identities.
What to watch every day
Snowflake advises monitoring LOGIN_HISTORY, SESSIONS, and QUERY_HISTORY in SNOWFLAKE.ACCOUNT_USAGE. Look for failed logins, logins from new IPs, mass exports, and unusual query volume. Treat suspect client and platform signals as high priority.
Snowflake flags tools such as rapeflake and DBeaver on Windows Server 2022 in this context. Pair that with new IP addresses, off-hours access, and large UNLOAD or COPY activity. CISA also urged Snowflake users to hunt with Snowflake detection queries and report positive findings to CISA.
How to recover after compromise
CISA advises quick containment, evidence preservation, and reporting, outlined in CISA's alert on Snowflake unauthorized access. Disable or reset compromised users immediately.
Revoke active sessions and tokens, then rotate passwords, keys, and OAuth secrets. Keep one clean timeline of first bad login, data accessed, and actions taken.
- Revoke sessions, OAuth tokens, and PATs for affected users.
- Audit role grants, warehouse use, and recent exports.
- Preserve LOGIN_HISTORY, QUERY_HISTORY, and cloud audit logs.
- Report to CISA and law enforcement and follow Snowflake prevention steps.
You Might Also Like
- Cybersecurity — Critical Infrastructure Attack Prevention Guide: Controls, Monitoring, and Recovery
- Vendor Data Breach Investigation Guide: Evidence, Notices, and Verification
- Tech Company Data Breach News 2026 Guide: exposure, response, and recovery; Key Facts and Questions to Ask