Stolen Qubole credentials opened dozens of companies’ AWS accounts

Security researchers say an attacker used stolen credentials belonging to Qubole, a big-data analytics platform, to get into the Amazon Web Services (AWS) accounts of dozens of its customers and copy their data. The cloud security firm Wiz published its investigation on November 9, working with the data security firm Sentra, which spotted the activity first, and Mandiant.

This is a breach at businesses, not a consumer app. But the companies hit hold data about their own customers and staff, so it can reach ordinary people later through those companies’ breach notices.

How it worked

Companies that used Qubole let it work inside their AWS accounts by creating a special role that trusts Qubole’s AWS account. That’s the standard, recommended way to connect a vendor. Wiz says that between October 14 and October 26, 2026, an attacker used two IAM users (sign-in identities) from an AWS account Qubole’s platform uses, and took on those trusted roles in customer accounts.

Every request included the right “External ID”, an extra code AWS recommends so only the real vendor can use the role, and every one worked. As Sentra put it, as far as AWS could tell, “the attacker was Qubole.” Wiz says the activity came from Mullvad VPN addresses and a server rented from OVH, not from Qubole’s own systems.

Many of the roles were no longer in use. Sentra says Qubole’s roles had been dormant since the spring, still in place long after companies had stopped using the service. In most environments Wiz looked at, the attacker’s requests were the only use of those roles in October.

What was taken

Once inside, Wiz and Sentra say the attacker:

• listed what the role could reach, then downloaded files from every S3 storage bucket it could access, rather than hunting for specific data
• read stored secrets from AWS Secrets Manager, SSM Parameter Store, Lambda settings and EC2 startup scripts, including source-control, identity-provider, database and CI credentials
• tested the keys it found with a tool called TruffleHog, including AWS keys and Microsoft Entra ID and Okta credentials

Sentra counts more than a dozen organizations hit, says it saw about 100 passwords and keys read in seven minutes, and says that across one company’s accounts the attacker downloaded millions of files. It describes thousands of customer-profile files taken in an early pass and production database backups taken in a final one. BleepingComputer reports that Sentra confirmed dozens of victims. The attacker changed nothing and deleted nothing, which Sentra says made it harder to notice.

Wiz also saw a separate burst from October 8 to 11, when an actor tested customer-owned AWS keys it believes were created for Qubole integrations, and in a few cases used them to break in.

What’s still unknown

Neither Wiz nor Sentra says how the Qubole credentials were stolen, and neither names the victims. BleepingComputer said it couldn’t find a public statement from Qubole and had asked the company for comment. AWS told BleepingComputer its services “were not compromised by this issue and operated as designed.”

What you can do

If your organization ever connected Qubole to AWS, Wiz recommends that you:

1. Review CloudTrail logs from October 1, 2026 onward in every account with a Qubole role, looking for role use from Qubole’s account, then any secret or S3 access that followed.
2. Rotate every secret that was read, and revoke active role sessions.
3. Remove integration roles you no longer use, and limit what the rest can reach. Adding source-network conditions to trust policies helps too.

For everyone else, a vendor you’ve never heard of can still be the way your data leaks. If you get a breach notice that mentions a “third-party provider” or a cloud vendor, take it seriously and follow its steps.

How Frame helps

The victims haven’t been named, so there isn’t a specific breach to add yet. If one of them notifies customers and the breach is added to a breach catalog, add it to a verified email in Frame and Frame shows what it exposed and gives you a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• Railway’s final report: stolen AI keys ran up about $740,000 in charges: another cloud break-in where a trust setting was the way in.
• Northflank tells every customer to assume their secrets were decrypted: another case of cloud secrets taken in bulk this fall.

Sources

• Wiz, Trusted by Default: Qubole Cross-Account Access Abused in the Wild, November 9, 2026
• Sentra, One Stolen Vendor Key, Every Customer’s Data Exposed: Inside the Qubole Supply Chain Attack, November 2026
• BleepingComputer, Hackers exploit trusted AWS access to breach multiple cloud environments, November 10, 2026