[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2D5NWB59gQAGdxOP2D7iXfItiZvuSrvgeucIi_VTbHs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":49},"a2034891-5547-428c-8080-9a8b347c0de4","mfa-absence-enabled-mass-snowflake-account-compromise","afb903cb-34b8-4171-9e54-579188d6f2af","MFA Absence Enabled Mass Snowflake Account Compromise","Connor Moucka exploited a fundamental access control failure: Snowflake customer accounts without multi-factor authentication (MFA) were accessible using only stolen credentials, which are routinely available via infostealer malware and credential marketplaces. The absence of MFA transformed credential theft into a direct path to sensitive data across 165 organizations, including the records of over 100 million AT&T customers. This incident demonstrates that even a reputable cloud platform cannot protect customers who neglect basic authentication hygiene. The $2.5 million extortion outcome underscores that weak configurations in cloud environments carry real financial and reputational consequences, and that organizations remain accountable for their own security posture within shared-responsibility models.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all cloud service accounts, especially those with access to sensitive or bulk data.\n- Audit all active cloud platform credentials and revoke any that are unused, overprivileged, or potentially exposed in credential breach databases.\n\n**Long-term improvements:**\n- Adopt a zero-trust authentication posture requiring MFA, conditional access policies, and least-privilege roles for every cloud service integration.\n- Establish a formal cloud security baseline that includes mandatory MFA, session timeout policies, and regular credential rotation as non-negotiable standards.\n- Include cloud account security hygiene requirements in third-party and SaaS vendor onboarding agreements to enforce shared-responsibility obligations.\n\n**Detection measures:**\n- Implement continuous monitoring for anomalous login activity, including logins from new geolocations or IP addresses not seen in historical baselines.\n- Subscribe to credential breach intelligence feeds to detect when employee or service account credentials appear in stealer logs or dark web dumps.",[12,13,14,15,16,17,18,19,20],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","NIST SP 800-53 IA-2: Identification and Authentication (MFA)","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST CSF PR.AC-1: Identities and credentials are managed","GDPR Article 32: Security of Processing (appropriate technical measures)","ISO\u002FIEC 27001 A.9.4: System and Application Access Control","NIST SP 800-63B: Digital Identity Guidelines (Authenticator Assurance Level 2+)",{},"published","2026-08-06T18:20:23.255722+00:00","2026-08-06T18:20:23.14+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F08\u002Fcanadian-man-pleads-guilty-in-snowflake-extortions\u002F","canadian-man-pleads-guilty-in-snowflake-extortions-58eb3c","Canadian Man Pleads Guilty in Snowflake Extortions",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":37,"name":38,"slug":39,"description":40,"color":41},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[43],{"id":44,"date":45,"edition":46,"title":47,"audio_url":48},"a53d647d-c82b-48df-a42a-e4ddbd1dd32a","2026-08-07","morning","ThreatNoir Morning Brief — August 7","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-07\u002Fthreatnoir-morning-brief-2026-08-07.mp3",[50,54,58],{"slug":51,"name":52,"problem":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":55,"name":56,"problem":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":59,"name":60,"problem":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed."]