Ticketmaster’s Snowflake data breach was just one of 165

Security researchers are reporting that a “significant volume of data” was stolen from hundreds of Snowflake cloud storage customers through compromised login credentials, with the incident linked to massive data breaches at Ticketmaster and Banco Santander.

Mandiant, a security company investigating data theft together with Snowflake, announced on Monday which traced the activity to a “financially motivated threat actor” identified as UNC5537. The two companies have notified at least 165 Snowflake client organizations that may have been compromised since the ongoing threat activity was discovered in April, with Mandiant saying its investigation found “no evidence to suggest” that Snowflake’s corporate environment was violated.

Recent data breaches in Ticketmaster, Santander Bankand subsidiary of LendingTree Quotation Assistant were linked to Snowflake cloud storage accounts used by companies. Official details about how the accounts were compromised have been scarce until now, with a previous third-party report being taken offline after Snowflake issued a statement claiming that the platform itself is not to blame.

Following its investigation, Mandiant says the as-yet-unidentified UNC5537 group is “systematically compromising” Snowflake customers using login credentials stolen by historical infostealer malware infections on systems not owned by Snowflake. Some of these credentials date back to 2020 and allowed UNC5537 to steal data from Snowflake client instances in an attempt to sell it on cybercriminal forums and extort victims.

Mandiant says the UNC5537 campaign resulted in “numerous successful compromises” due to poor security practices on affected accounts that failed to update stolen login credentials or utilize multi-factor authentication (MFA) or network whitelists. The list of victims, although largely unidentified, is also expected to grow, according to Mandiant, having assessed that UNC5337 will likely target additional platforms “in the near future.”