Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Attackers exploited compromised Qubole AWS IAM credentials to assume cross-account roles that victim organizations had configured for Qubole's use, gaining unauthorized access to their AWS environments. The core failure was that organizations never revoked or audited these IAM roles after discontinuing their use of Qubole, leaving persistent, privileged access pathways open for years. This is a textbook supply chain access control failure: trusting a third-party vendor with standing cloud permissions without enforcing a lifecycle process to remove that trust when the relationship ends. The incident highlights how third-party integrations create implicit, long-lived attack surfaces that are frequently forgotten. Attackers had a 12-day window to enumerate resources, harvest secrets, and exfiltrate data entirely because no one was watching these dormant roles.