In 2024 attackers stole data from many companies using Snowflake by logging in with credentials taken from infostealer malware, not by breaching the Snowflake platform. Affected accounts lacked multi-factor authentication, so valid stolen logins were enough. It remains one of the clearest cases of stealer-log credentials driving mass cloud data theft.

The 2024 Snowflake customer data theft campaign became one of the most significant credential-based cloud attacks in recent years. Unlike many large-scale incidents, investigators found no evidence that attackers exploited a vulnerability in the Snowflake platform itself. Instead, they accessed customer environments using legitimate usernames and passwords that had previously been stolen by infostealer malware.

The campaign demonstrated how credentials collected months or even years earlier can still create serious business risk if they remain active. Combined with accounts that lacked multi-factor authentication (MFA), those stolen credentials allowed attackers to access cloud environments as authorised users and extract large volumes of sensitive data.

The incident reinforced an important lesson for security teams. Cloud security depends not only on the provider’s platform but also on protecting customer identities from credential theft.

What Happened and When

In May and June 2024, security researchers and incident response teams identified a series of intrusions affecting organisations that used Snowflake’s cloud data platform.

Several well-known companies disclosed customer data theft after attackers accessed their Snowflake environments using valid credentials. Victims publicly linked to the campaign included organisations such as Ticketmaster and Santander, although additional organisations were also reported during ongoing investigations. Mandiant and Snowflake both confirmed that multiple customer environments had been accessed through compromised credentials rather than exploitation of the platform itself.

The threat activity was attributed by Mandiant to a financially motivated threat actor tracked as UNC5537, which specialised in using stolen credentials to access cloud services before conducting data theft and extortion.

Rather than targeting Snowflake’s infrastructure, attackers authenticated directly into customer accounts using legitimate login details.

This distinction became one of the defining characteristics of the campaign.

The Key Point: No Platform Breach, Valid Stolen Credentials

One of the biggest misconceptions surrounding the incident was that Snowflake itself had been hacked.

Investigations by Snowflake and Mandiant found no evidence of a vulnerability, misconfiguration, or compromise within the Snowflake platform that allowed attackers to access customer environments. Instead, every confirmed intrusion involved valid customer credentials.

According to Mandiant, many of these credentials originated from infostealer malware infections on employee workstations. Infostealer malware extracts usernames, passwords, browser cookies, authentication tokens, and other sensitive data before packaging the information into stealer logs that are later traded within criminal communities.

Attackers simply searched these stolen datasets for Snowflake credentials belonging to enterprise users and then authenticated using those valid identities.

No software exploit was required.

Why the Logins Worked

The success of the campaign came down to identity security rather than cloud platform security.

Investigators found several common characteristics across affected organisations:

• Accounts protected only by usernames and passwords
• MFA not enabled on compromised accounts
• Credentials that had remained unchanged after earlier exposure
• Credentials that, in some cases, originated from infostealer infections dating back several years

Mandiant reported that some compromised credentials had been harvested as early as 2020, demonstrating that old credential exposures can remain valuable if passwords are never changed and additional authentication controls are absent.

This highlights an important reality.

Credential theft is not always an immediate incident. A stolen password may remain unused for months or years before attackers discover an opportunity to exploit it.

Without MFA, attackers can simply authenticate as legitimate users and access cloud resources through normal login processes.

The Scale

Although investigations continued throughout 2024, the campaign affected numerous organisations across multiple industries.

Public reporting connected the activity to customer environments belonging to:

• Ticketmaster
• Santander
• Advance Auto Parts
• Neiman Marcus

Additional organisations were investigated as incident response efforts progressed. Mandiant stated that UNC5537 targeted a wide range of Snowflake customer environments using the same credential-driven methodology.

The consistency of the attack technique demonstrated how attackers can reuse the same stolen credential collections across multiple organisations.

Instead of finding new vulnerabilities for every target, they simply authenticated wherever previously stolen credentials remained valid.

The Lesson: Stealer Logs Turn Old Infections Into Fresh Breaches

The Snowflake campaign demonstrated the long-term value of stealer logs for cybercriminals.

An employee infected with infostealer malware today may unknowingly expose credentials that remain useful long after the original infection has been removed.

Those credentials often circulate through underground communities operating across Tor, Telegram and I2P, alongside criminal forums and marketplaces. Attackers continually search these datasets for valuable enterprise accounts.

DarkThreatX continuously monitors 100B+ records across these criminal intelligence sources, including relevant activity across Tor, Telegram and I2P, together with underground forums and marketplaces. The platform indexes more than 1 million new stealer logs every week, operates 24/7, delivers alerts in under five minutes, and reports zero false positives.

The Snowflake incident shows why this matters.

Credential exposure is often the first stage of an attack, while data theft may occur weeks, months, or even years later.

Reducing the time between exposure and detection gives security teams a greater opportunity to invalidate stolen credentials before attackers use them.

Detection and Prevention

The Snowflake campaign provides several practical lessons for organisations using cloud platforms.

Continuously Monitor Credential Exposure

Continuous enterprise dark web monitoring provides visibility when employee identities appear within newly identified credential exposures or stealer logs.

Early detection allows organisations to respond before attackers attempt authentication.

Monitor Employee Credentials

Dedicated employee credential monitoring helps identify exposed business identities that may otherwise remain unnoticed for extended periods.

Enforce MFA Everywhere

Every externally accessible service should require MFA.

Even when passwords are stolen, MFA significantly reduces the likelihood that attackers can successfully authenticate.

Rotate Exposed Credentials

When credentials appear in criminal datasets, organisations should immediately:

• Reset passwords
• Revoke active sessions
• Review authentication logs
• Investigate affected endpoints for infostealer malware
• Confirm MFA is enabled

Improve Endpoint Security

Because infostealer malware begins on employee devices, organisations should strengthen endpoint detection, application controls, phishing awareness, and browser security to reduce initial infections.

Conclusion

The 2024 Snowflake customer data theft campaign was not the result of a cloud platform compromise.

Instead, it demonstrated how stolen credentials collected through infostealer malware can become the foundation for large-scale enterprise data theft when organisations fail to protect accounts with MFA and ongoing credential monitoring.

As cloud adoption continues to grow, identity security remains one of the most important layers of defence.

Monitoring exposed credentials, responding quickly to new stealer logs, enforcing MFA, and maintaining strong session hygiene all help reduce the opportunity for attackers to turn old credential theft into new business breaches.

Frequently Asked Questions

How did the Snowflake customer data theft happen?

Attackers accessed customer Snowflake environments using valid usernames and passwords that had previously been stolen by infostealer malware. Rather than exploiting the Snowflake platform, they authenticated as legitimate users using exposed credentials obtained from stealer logs.

Was Snowflake itself breached in 2024?

No. Investigations by Snowflake and Mandiant found no evidence that the Snowflake platform itself had been compromised. The attackers gained access by using stolen customer credentials against individual Snowflake accounts rather than exploiting a platform vulnerability.

Why did MFA matter in the Snowflake case?

Many affected accounts did not have multi-factor authentication enabled. Because attackers already possessed valid usernames and passwords, they could successfully authenticate without encountering an additional verification step that might have blocked unauthorised access.

How can enterprises prevent this?

Organisations should enforce MFA on every externally accessible account, continuously monitor for exposed credentials, promptly reset compromised passwords, revoke active sessions, and investigate endpoints for infostealer malware. Reducing the time between credential exposure and response significantly lowers the risk of successful account compromise.