An attacker exploited Qubole's trusted AWS access to breach customer accounts and steal data between October 14 and October 26, 2026. The breach involved the use of credentials from an AWS account associated with Qubole to assume IAM roles created by customers.
The AWS account ID used by Qubole for these operations is 805246085872. The attacker accessed stored secrets and data, including AWS access keys, Entra ID client secrets, and Okta client credentials. Data exfiltration occurred from S3 buckets accessible to the assumed roles.
Sentra identified the attack by observing suspicious activity across several customer environments. The attacker initially used the IAM user AIDA3W7DIFLYOLTK63SFS for most activities and later switched to AIDAJYRRH5Y3A7AAJM2HW.
Every AssumeRole request made by the attacker included an External ID and was accepted due to existing trust policies. The attacker used TruffleHog to validate and test the discovered credentials.
Organizations that connected Qubole to AWS are advised to check their CloudTrail logs for suspicious AssumeRole requests to identify potential unauthorized access.