Supply chain attack on Qubole customers

A compromise of Qubole credentials let an attacker exploit cloud roles that multiple organizations had previously granted the data platform. In one affected customer, the roles had been unused for months but retained broad access to S3 buckets and credential stores. The attacker’s sessions appeared valid, including the required AWS ExternalId, but their behavior was anomalous: dormant roles suddenly became active from OVH and Mullvad addresses, with no normal Qubole activity. The campaign moved from testing a low-value role to accessing more than a dozen trusted accounts in minutes, downloading millions of files, production backups, and nearly 100 passwords and keys from Secrets Manager, SSM Parameter Store, Lambda variables, and EC2 startup scripts. No data was altered, and the attacker went quiet while the access remained in place.

Sentra describes how it traced leaked files to source buckets, narrowed hundreds of possible identities to external vendors, and identified Qubole by comparing activity against its history. It established what had been taken using encryption, secret-access, and file-access logs, alongside prior classification of sensitive data; some unencrypted file reads could not be fully counted. Within a day, the customer was advised to remove Qubole’s roles, rotate exposed secrets, block attacker IPs, preserve logs, and notify Qubole. Sentra also found the same dormant-role pattern among other customers and alerted them. The central lesson is that vendor access can remain dangerous even when configured according to standard practice: remove unused integrations, restrict vendors to necessary data and networks, and monitor how identities actually use data.