Snowflake Data Breach

The Snowflake data breach refers to a large-scale cybersecurity incident in 2024 involving unauthorized access to customer cloud environments hosted on Snowflake Inc. , a cloud-based data and AI platform. [ 1 ] [ 2 ] The breach affected numerous high-profile clients and has been regarded as one of the most significant data security incidents of the decade. [ 3 ]

Snowflake Inc. provides a cloud data and AI platform widely adopted by large enterprises for storing and analyzing data. In 2024, it became the focal point of a major cyberattack campaign that compromised sensitive data from more than 100 of its customers. [ 4 ]

In mid-2024, at least 160 organizations were reportedly targeted through vulnerabilities in how their Snowflake environments were configured and accessed. Affected companies included AT&T , Ticketmaster / Live Nation , Santander Bank , LendingTree , Advance Auto Parts , Neiman Marcus , and Bausch Health . [ 4 ] [ 5 ]

The breach resulted in the theft of a wide range of sensitive data, such as:

Personally Identifiable Information (PII) [ 4 ]

Medical prescriber DEA numbers [ 4 ]

Digital event tickets [ 4 ]

Over 50 billion call records from AT&T [ 4 ]

The stolen data was allegedly used for extortion by the ShinyHunters extortion group, with hackers demanding ransoms from affected organizations in exchange for not leaking or selling the information. [ 6 ]

Security investigations revealed that the attackers—members of a known hacking group referred to as UNC5537 , Scattered Spider or ShinyHunters —accessed customer environments by exploiting stolen credentials obtained via infostealer malware . [ 7 ] These credentials, which lacked multi-factor authentication (MFA) protection in many cases, allowed the attackers to log in to Snowflake customer instances directly using just a username and password. [ 8 ]

A report by cybersecurity firm, Mandiant (a subsidiary of Google Cloud) outlined the method of extortion and scale of the incident, noting that over 160 customer environments may have been accessed. [ 9 ] [ 10 ]

Impact and government response

The breach had particularly serious implications for AT&T , whose call and text message metadata involving nearly all U.S. customers was compromised. [ 1 ] [ 4 ] The breach prompted an unprecedented request from the U.S. Department of Justice , which asked AT&T to delay public disclosure due to national security and public safety concerns. [ 1 ] [ 4 ] Reports later confirmed that AT&T paid a ransom of $370,000 in an attempt to have the stolen data deleted. [ 11 ] [ 12 ]

Arrests and attribution

In late 2024, law enforcement agencies in the United States and Canada identified and apprehended two core individuals allegedly responsible for the attack:

Connor Riley Moucka, 25 (aliases: Waifu , Judische , Ellyel8 ), was arrested in Kitchener, Ontario , Canada on October 30, 2024. [ 13 ] He faces multiple charges in Washington state , including conspiracy , computer fraud , extortion , and identity theft . [ 13 ] [ 14 ]

John Erin Binns, 24 (aliases: IRDev , IntelSecrets ), was arrested in Turkey in May 2024. [ 15 ] He is currently detained pending possible extradition to the United States, where he also faces charges linked to the 2021 T-Mobile breach . [ 16 ]

Court documents also reference a third unnamed individual, known only by the alias Reddington , who allegedly acted as an intermediary between the hackers and victim organizations. [ 11 ]

Security implications

The breach drew attention to widespread security misconfigurations and insufficient enforcement of multi-factor authentication across cloud platforms. It also raised concerns over third-party risk and the need for tighter access controls and credential hygiene within cloud ecosystems. [ 1 ]

List of data breaches

1 2 3 4 Matt Egan and Sean Lyngaas, "Nearly all AT&T cell customers' call and text records exposed in a massive breach" . edition.cnn.com. 12 June 2024 . Retrieved 22 May 2025 .

↑ "Ticketmaster confirms hack which could affect 560m" . bbc.com. 2 June 2024 . Retrieved 22 May 2025 .

↑ Jordan Smith, "The Cybersecurity Stories that Defined 2024 in the Channel" . channelinsider.com. 17 December 2024 . Retrieved 22 May 2025 .

1 2 3 4 5 6 7 8 Kim Zetter, "The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever" . wired.com. 17 June 2024 . Retrieved 22 May 2025 .

↑ Sergiu Gatlan, "Advance Auto Parts stolen data for sale after Snowflake attack" . bleepingcomputer.com. 5 June 2024 . Retrieved 22 May 2025 .

↑ Mathew J. Schwartz, "Victims of Snowflake Data Breach Receive Ransom Demands" . bankinfosecurity.com. 20 June 2024 . Retrieved 22 May 2025 .

↑ Jessica Lyons, "Snowflake customers not using MFA are not unique – over 165 of them have been compromised" . theregister.com. 11 June 2024 . Retrieved 22 May 2025 .

↑ Ravie Lakshmanan, "Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign" . thehackernews.com. 11 June 2024 . Retrieved 22 May 2025 .

↑ "UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion" . cloud.google.com. 10 June 2024 . Retrieved 22 May 2025 .

↑ "Unpacking the 2024 Snowflake Data Breach" . cloudsecurityalliance.org. 7 May 2025 . Retrieved 22 May 2025 .

1 2 Kim Zetter, "AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records" . wired.com. 14 July 2024 . Retrieved 22 May 2025 .

↑ Wes Davis, "AT&T reportedly gave $370,000 to a hacker to delete its stolen customer data" . theverge.com . Retrieved 22 May 2025 .

1 2 Jonathan Greig, "Alleged Snowflake hacker consents to extradition from Canada after US charges" . therecord.media. 25 March 2025 . Retrieved 22 May 2025 .

↑ "Charges Unsealed Against Alleged Hackers of Snowflake Customers" . bloomberg.com. 24 November 2024 . Retrieved 22 May 2025 .

↑ "Canadian Man Arrested in Snowflake Data Extortions – Krebs on Security" . wancore.fr . Retrieved 22 May 2025 .

↑ "Canadian Man Arrested in Snowflake Data Extortions" . krebsonsecurity.com. 5 November 2024 . Retrieved 22 May 2025 .

Data breaches in the United States

Articles with short description

Short description matches Wikidata