Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets

Cybersecuritynews •Tushar Subhra Dutta • November 10, 2026

Hackers abused trusted Qubole integrations to enter customer AWS accounts, steal secrets, and download data from Amazon S3, sometimes taking entire buckets in one session. The activity ran from October 14 through October 26, 2026, using IAM credentials from an AWS account associated with Qubole rather than exploiting a software vulnerability. The attackers relied on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qubole Supply Chain Attack Compromises AWS Customer Accounts Between October 14 and October 26, 2026, a threat actor exploited AWS cross-account IAM roles linked to Qubole, a data lake platform, to access multiple customer environments and steal sensitive data. The attacker used IAM credentials from Qubole's AWS account to assume roles in customer accounts, allowing them to enumerate resources, extract secrets, and download data from S3 buckets. The attack was identified by Wiz, in collaboration with Sentra and Mandiant, who reported that the compromised roles were often unused but still trusted Qubole's account. The attacker also employed tools like TruffleHog to validate stolen credentials, including AWS access keys and Okta client secrets. Organizations that had connected Qubole to AWS are advised to review CloudTrail logs for suspicious AssumeRole requests and take immediate action to secure their environments. As of now, neither Qubole nor Idera has issued a public statement regarding the incident. 8 sources 68

Extracted Entities

Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)