---
title: "Snowflake UNC5537: Customer Accounts Hit With Stolen Logins"
url: https://erroneo.us/security/briefs/snowflake-unc5537-customer-account-breaches/
description: "About 165 Snowflake customers were exposed via infostealer passwords on accounts without MFA. No Snowflake flaw. Enforce MFA and network policies."
type: security-brief
section: "Security Digest"
date_published: 2024-06-02
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Snowflake UNC5537: Customer Accounts Hit With Stolen Logins

**Verdict: Check exposure.** There was no Snowflake bug to patch; the lesson is that any cloud data platform reachable with a password alone will eventually be logged into by someone holding an infostealer log.

- **Who must act:** Anyone running Snowflake or a similar SaaS data warehouse with human or service users that still sign in with a password and no second factor, key pair or SSO, or without a network allow list.
- **Who can relax:** Accounts that already enforce MFA or SSO for every human user, key-pair or OAuth auth for service users, and network policies did not match the pattern Mandiant found in this campaign.
- **Affected:** Snowflake customer accounts with users signing in by single-factor password (no MFA); Accounts whose credentials appeared in infostealer logs and were never rotated; Accounts without network policies (IP allow lists)
- **Fixed:** No product patch (not a Snowflake vulnerability); Snowflake MFA rollout: MFA required for all human users with no exceptions in Phase 3 (August-October 2026, rolling by account)
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Enforce MFA or SSO for every human user via an authentication policy; do not wait for your account's enforcement date
2. Move service users to key-pair or OAuth authentication and block password auth for them
3. Apply network policies so only known IP ranges can authenticate
4. Rotate any credential that has ever lived on an unmanaged or personal machine
5. Review LOGIN_HISTORY and QUERY_HISTORY for the client and query patterns Mandiant documented

### How to check if you are affected

- Query SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY for password-only logins from VPN or VPS ranges and unfamiliar client applications, e.g. DBeaver from a host you do not manage
- Search QUERY_HISTORY for SHOW TABLES reconnaissance followed by CREATE TEMPORARY STAGE, COPY INTO and GET from the same session
- Check whether any user's credentials appear in infostealer or breach monitoring feeds

## What happened

In spring 2024 a financially motivated group that Mandiant tracks as UNC5537 logged into Snowflake customer accounts with stolen usernames and passwords, copied out large tables, and then extorted the victims or tried to sell the data. On June 2, 2024 Snowflake reported a rise in threat activity aimed at customer accounts, and [CISA amplified the warning on June 3](https://www.cisa.gov/news-events/alerts/2024/06/03/snowflake-recommends-customers-take-steps-prevent-unauthorized-access).

[Mandiant's June 10 report](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) lays out the mechanics. It found no evidence of a breach of Snowflake's own enterprise environment. Every incident it worked traced back to compromised customer credentials. At least 79.7% of the accounts used had prior credential exposure, and the oldest related infostealer infection dated to November 2020. The infostealers named were VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER. Mandiant and Snowflake notified about 165 potentially exposed organizations. Once inside, the actor ran reconnaissance with a tool Mandiant calls FROSTBITE and ran queries from DBeaver Ultimate. It then staged and pulled data with `CREATE TEMPORARY STAGE`, `COPY INTO` and `GET`, working from commercial VPN addresses and VPS infrastructure and storing loot on MEGA.

## Who is affected

Mandiant named three factors common to the victims: no MFA, credentials left valid and unrotated (in some cases for years), and no network allow lists. Some victims disclosed directly. Live Nation's [May 31, 2024 8-K](https://www.sec.gov/Archives/edgar/data/1335258/000133525824000081/lyv-20240520.htm) reported unauthorized activity on May 20 in a "third-party cloud database environment" holding mainly Ticketmaster data, plus a dark-web sale offer on May 27. The filing itself does not name Snowflake. In July, [AT&T disclosed](https://www.bleepingcomputer.com/news/security/massive-atandt-data-breach-exposes-call-logs-of-109-million-customers/) that call and text metadata for about 109 million customers was taken from its Snowflake account between April 14 and April 25, 2024. The same report lists Advance Auto Parts, Pure Storage, Los Angeles Unified, Neiman Marcus and Banco Santander among the reported victims. These are as reported by the press, and we did not check each one against a primary disclosure.

## Do you really need to act?

There is nothing to patch, so the honest question is whether you have password-only users. If you do, you are exposed in exactly the way these victims were, whether or not you use Snowflake. Snowflake has since been [phasing out single-factor password sign-in](https://docs.snowflake.com/en/user-guide/security-mfa-rollout). Phase 3, rolling by account from August to October 2026, requires MFA for all human users "with no exceptions" and blocks password auth for non-human users. Reader accounts, trial accounts and Snowflake Postgres are exempt. If your account has not yet been enforced, do it yourself rather than wait.

The case also went to court. [Krebs reported in August 2026](https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/) that Connor Moucka pleaded guilty over the campaign, with sentencing set for October 27. Prosecutors say the conspirators collected over $2.5 million in ransom payments.

## What to do now

1. Create an authentication policy that requires MFA or SSO for every human user, and apply it account-wide.
2. Move service users (ETL, BI and dbt jobs) to key-pair or OAuth authentication, then remove their passwords.
3. Add network policies so only your egress IP ranges can authenticate.
4. Rotate every credential that was ever typed on a contractor's or personal device, since infostealer logs persist for years.
5. Repeat the exercise for your other SaaS data platforms (warehouses, BI and CRM). The technique is not Snowflake-specific.

## How to tell if you were hit

Review `SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY` for password-only logins from VPN or VPS address space and for unusual client strings such as DBeaver from hosts you do not manage. In `QUERY_HISTORY`, look for sessions that run `SHOW TABLES` and then temporary stages, `COPY INTO` and `GET`. That is the staging-and-exfiltration sequence [Mandiant documented](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion). An unexplained extortion email that quotes your table names is, unfortunately, also a reliable indicator.

## Timeline

- Nov 2020 — Earliest infostealer infection Mandiant tied to credentials used in the campaign.
- Apr 14, 2024 — Start of the AT&T data theft window (through April 25).
- May 22, 2024 — Mandiant and Snowflake begin notifying potentially exposed organizations.
- May 31, 2024 — Live Nation files an 8-K on the Ticketmaster data incident.
- Jun 2, 2024 — Snowflake reports increased threat activity against customer accounts. CISA alerts on June 3.
- Jun 10, 2024 — Mandiant publishes its UNC5537 report.
- Jul 12, 2024 — AT&T discloses theft of call records for about 109 million customers.
- Aug 6, 2026 — Moucka guilty plea reported.

## Sources

1. [Google Cloud / Mandiant — UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion)
2. [CISA — Snowflake Recommends Customers Take Steps to Prevent Unauthorized Access](https://www.cisa.gov/news-events/alerts/2024/06/03/snowflake-recommends-customers-take-steps-prevent-unauthorized-access)
3. [Snowflake Documentation — MFA rollout and single-factor password deprecation](https://docs.snowflake.com/en/user-guide/security-mfa-rollout)
4. [SEC — Live Nation Entertainment Form 8-K (May 31, 2024)](https://www.sec.gov/Archives/edgar/data/1335258/000133525824000081/lyv-20240520.htm)
5. [BleepingComputer — Massive AT&T data breach exposes call logs of 109 million customers](https://www.bleepingcomputer.com/news/security/massive-atandt-data-breach-exposes-call-logs-of-109-million-customers/)
6. [Krebs on Security — Canadian Man Pleads Guilty in Snowflake Extortions](https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/)

---
Source page: https://erroneo.us/security/briefs/snowflake-unc5537-customer-account-breaches/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt