Attacker uses a data platform's trusted AWS access to steal secrets and files from dozens of customers
November 9, 2026 (Attacks October 14 to 26, disclosed November 9, 2026)
Qubole is a data lake platform that works inside its customers' Amazon Web Services accounts through access roles that customers create to trust Qubole's own AWS account. Wiz reported on November 9 that between October 14 and 26 an attacker used two compromised user identities in Qubole's AWS account to take on those roles in multiple customer accounts. In most of them the roles were no longer in normal use, and every request carried the expected security code, so the access looked legitimate. The attacker read secrets stored in Lambda settings, Secrets Manager and Parameter Store, tested the AWS, Microsoft Entra ID and Okta credentials it found, and downloaded S3 files, sometimes whole buckets. BleepingComputer reports tens of affected companies, with Sentra confirming dozens of victims and millions of files taken from one customer. How Qubole's credentials were stolen is not known, and Qubole had made no public statement by November 10. AWS says its services were not compromised. A separate actor used customer AWS keys set up for Qubole on October 8 to 11, and Wiz has not linked the two.
Why it matters
Access granted to a vendor stays open until the customer removes it, even after the vendor is no longer used. One stolen vendor credential became a key to many companies' clouds.
What defenders can take from it
- Review CloudTrail from October 1 for role assumptions by Qubole's AWS account from addresses outside AWS.
- Rotate every secret the vendor roles could read, end active sessions and delete roles for vendors you no longer use.
- Limit vendor trust policies to specific identities and source addresses, and turn on S3 data-access logging for sensitive buckets.