[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnU8x29QMGKx-O2fdw3wTV582GohMX9Xrt7T6XSvW_eg":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"f0d294c2-a1de-497e-9655-579e386ed93f","Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data","hackers-exploit-qubole-s-trusted-aws-access-to-breach-customer-accounts-and-stea-ee5e2c","An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed. Qubole, a data lake platform owned by Idera,","An attacker compromised multiple AWS customer accounts between October 14–26 by leveraging credentials for an AWS account that Qubole's data lake platform uses to access those customers. The breach resulted in the theft of stored secrets and data. The method by which the attacker obtained Qubole's AWS credentials has not been disclosed.","Attacker exploited Qubole's AWS credentials to breach multiple customer accounts and steal secrets and data.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-exploit-quboles-trusted-aws.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjj3p_1P-Ko_l_HuUr2Doq9kJOQa3Y5dCrkiVWqjJXzvQfYgKvgJXyvdBqLH2hp7s_ZY2kk-hhaCQhjf_v9SdjSbNpaDV2Eohk6-NEFUZp_ROjMJf_Q1xUSKcrqNj-Dd5ZrfjV6uP1blo579IaZ6hgHxOFAUhyJVgdGop-KVIWCjWQIYOKku3iN1N1EIUk\u002Fs1600\u002Faws-hacked.jpg","2026-11-09T17:51:21+00:00","2026-11-09T19:00:27.597496+00:00",8,[17,20,22,24],{"name":18,"type":19},"Qubole","vendor",{"name":21,"type":19},"Amazon Web Services",{"name":23,"type":19},"Idera",{"name":25,"type":19},"Wiz","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[21,18,23],{"controls":50,"vendors":137},[51,79,108],{"slug":52,"name":53,"problem":54,"products":55},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[56,63,71],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":52,"product_name":60,"url":61,"description":62},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":80,"name":81,"problem":82,"products":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":109,"name":110,"problem":111,"products":112},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[138],{"slug":139,"name":25,"logo_path":140,"roles":141},"wiz","\u002Fvendor-logos\u002Fwiz.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"quboles-trusted-aws-credentials-weaponized-to-breach-customer-accounts","Qubole's Trusted AWS Credentials Weaponized to Breach Customer Accounts","Attackers exploited the inherent trust relationship between Qubole's data platform and its customers' AWS environments, using Qubole's own credentials to pivot laterally into multiple customer accounts and steal sensitive data. This is a classic supply chain attack: the vendor became the attack vector, bypassing any security controls the customers had in place individually. The fact that Qubole's credentials provided broad enough access to steal secrets and data suggests insufficient application of least-privilege principles in the cross-account trust model. Organizations that grant third-party vendors standing access to cloud environments face compounded risk when that vendor is compromised. This incident underscores why third-party access must be tightly scoped, continuously monitored, and subject to rigorous credential hygiene.",[148,149,150,151,152,153,154],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":156,"NIS2 Article 21(2)(b)":157,"MITRE ATT&CK T1566: Phishing":158,"CIS Control 5: Account Management":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"Customer data was stolen via a third-party processor (Qubole), triggering obligations under Article 32 to ensure processors implement appropriate technical measures—including access controls—to protect personal data.","NIS2 explicitly requires supply chain security measures including controls over third-party service relationships; Qubole's trusted access without adequate safeguards is precisely the risk this article targets.","While the exact method is undisclosed, credential theft from a SaaS vendor commonly involves phishing of vendor employees, making this technique relevant as a likely initial access vector.","Qubole's standing, likely over-privileged AWS credentials gave attackers broad access; enforcing least-privilege and eliminating long-lived third-party credentials directly addresses this failure.","While the credential theft vector is unknown, robust supply chain security practices under SI-2 require organizations to assess and remediate weaknesses in vendor-provided services that could expose customer environments.","Supplier access credentials represent a technical vulnerability surface; regular review and hardening of third-party access configurations would have reduced the attack's blast radius.","The breach hinged on compromised third-party credentials with excessive trust; this framework control mandates that access be granted on a least-privilege basis with strong identity verification, which would have limited the attacker's reach."]