MFA Absence Enabled Mass Snowflake Account Compromise
Written by AI from the linked story. Not reviewed by an editor. How this works
Connor Moucka exploited a fundamental access control failure: Snowflake customer accounts without multi-factor authentication (MFA) were accessible using only stolen credentials, which are routinely available via infostealer malware and credential marketplaces. The absence of MFA transformed credential theft into a direct path to sensitive data across 165 organizations, including the records of over 100 million AT&T customers. This incident demonstrates that even a reputable cloud platform cannot protect customers who neglect basic authentication hygiene. The $2.5 million extortion outcome underscores that weak configurations in cloud environments carry real financial and reputational consequences, and that organizations remain accountable for their own security posture within shared-responsibility models.
Tactical Insight
Immediate actions
- Enforce multi-factor authentication (MFA) on all cloud service accounts, especially those with access to sensitive or bulk data.
- Audit all active cloud platform credentials and revoke any that are unused, overprivileged, or potentially exposed in credential breach databases.
Long-term improvements
- Adopt a zero-trust authentication posture requiring MFA, conditional access policies, and least-privilege roles for every cloud service integration.
- Establish a formal cloud security baseline that includes mandatory MFA, session timeout policies, and regular credential rotation as non-negotiable standards.
- Include cloud account security hygiene requirements in third-party and SaaS vendor onboarding agreements to enforce shared-responsibility obligations.
Detection measures
- Implement continuous monitoring for anomalous login activity, including logins from new geolocations or IP addresses not seen in historical baselines.
- Subscribe to credential breach intelligence feeds to detect when employee or service account credentials appear in stealer logs or dark web dumps.