Threat watch / Campaign
Qubole: an attacker used the data platform's trusted AWS access to read customer secrets and data
Between October 14 and October 26, 2026, an attacker used IAM credentials from an AWS account associated with Qubole, a big-data platform, to assume the roles customers had created for it in their own AWS accounts. Wiz and Sentra, who disclosed the campaign on November 9, say the attacker read secrets, Lambda environment variables and parameters, then downloaded S3 data. How the attacker obtained Qubole's credentials is not known, and no statement from Qubole had been published.
- Sector
- Tech & SaaS
- Way in
- Supplier
- Product or vendor
- Qubole
- organizations impacted, according to Sentra (which also speaks of dozens of customers)[2]
- 12+
- How it happened
- The attacker called AssumeRole from Qubole's AWS account against the integration roles customers had set up for Qubole, and every request carried the right External ID. Many of those roles were otherwise unused. Wiz and Sentra do not say how the attacker got Qubole's credentials; the activity came from a rented OVH server and Mullvad VPN addresses, not from Qubole's network, according to Sentra.[1][2][3] Checked 10 Nov 2026
- What was stolen
- Secrets Manager values, SSM Parameter Store values and Lambda environment variables, which the attacker searched for credentials (AWS keys, Entra ID client secrets, Okta client credentials) and tested. It then downloaded data from any S3 bucket the role could reach, sometimes a whole bucket. Sentra speaks of customer-profile files and production database backups, and says nothing was changed or deleted.[1][2] Checked 10 Nov 2026
- Who was impacted
- Qubole customers whose AWS accounts still trusted Qubole's account: "more than a dozen organizations", and elsewhere "dozens of Qubole customers", according to Sentra. Wiz gives no count. Several victims had no S3 data-event logs, so which files were read is not known.[1][2] Checked 10 Nov 2026
- Threat actor
- Not attributed
Timeline
- From October 8 to 11, an actor uses customer-owned AWS access keys that Wiz believes were created for Qubole integrations, testing all of them within one hour on October 8. In a small number of cases it goes on to compromise the victim's cloud environment. Wiz has not linked this to the later role activity. [1]
- First role assumption from Qubole's AWS account by the attacker, from a Mullvad VPN address, according to Wiz. From October 15, most activity comes from an OVH server. [1]
- Last activity observed by Wiz using Qubole's credentials. [1]
- Wiz and Sentra publish their findings; Sentra says it found the activity and reported it to Wiz, which investigated with Sentra and Mandiant. Wiz says a source IP condition on the role "would have blocked every role assumption we observed". Neither Qubole nor its owner Idera had published a statement, according to The Hacker News. [1][2][3]