One Stolen Vendor Key, Every Customer’s Data Exposed: Inside the Qubole Supply Chain Attack

A stolen credential belonging to legacy big-data platform Qubole was used to access more than a dozen organizations that had granted the vendor cross-account cloud access, with the attacker reading roughly 100 passwords and keys in about seven minutes and performing zero write actions. Sentra uncovered the campaign and reported it to Wiz, which investigated alongside Sentra and Mandiant and published the findings as "Trusted by Default: Qubole Cross-Account Access Abused in the Wild." The attacker never breached the victim companies directly, instead entering through a trusted third-party integration whose standing access reached sensitive data, and the lack of any changes or deletions made the intrusion harder to detect. Sentra traced the leaked data to its source within hours by matching file contents rather than names, narrowing the exposure to a handful of S3 buckets. The incident underscores the risk posed by forgotten non-human identities—vendor integrations, automation and AI agents—that retain standing access to cloud data long after they are connected. What to watch next is whether customers audit and prune stale third-party access grants, and whether cloud providers move to tighten default cross-account trust.