Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

Attackers exploited the inherent trust relationship between Qubole's data platform and its customers' AWS environments, using Qubole's own credentials to pivot laterally into multiple customer accounts and steal sensitive data. This is a classic supply chain attack: the vendor became the attack vector, bypassing any security controls the customers had in place individually. The fact that Qubole's credentials provided broad enough access to steal secrets and data suggests insufficient application of least-privilege principles in the cross-account trust model. Organizations that grant third-party vendors standing access to cloud environments face compounded risk when that vendor is compromised. This incident underscores why third-party access must be tightly scoped, continuously monitored, and subject to rigorous credential hygiene.