Qubole Supply Chain Attack Compromises AWS Customer Accounts

• •Attackers exploited AWS IAM roles linked to Qubole to access customer data.
• •Sensitive information, including AWS and Okta credentials, was stolen during the attack.
• •Organizations are urged to audit their CloudTrail logs for suspicious activity.

Between October 14 and October 26, 2026, a threat actor exploited AWS cross-account IAM roles linked to Qubole, a data lake platform, to access multiple customer environments and steal sensitive data. The attacker used IAM credentials from Qubole's AWS account to assume roles in customer accounts, allowing them to enumerate resources, extract secrets, and download data from S3 buckets. The attack was identified by Wiz, in collaboration with Sentra and Mandiant, who reported that the compromised roles were often unused but still trusted Qubole's account. The attacker also employed tools like TruffleHog to validate stolen credentials, including AWS access keys and Okta client secrets. Organizations that had connected Qubole to AWS are advised to review CloudTrail logs for suspicious AssumeRole requests and take immediate action to secure their environments. As of now, neither Qubole nor Idera has issued a public statement regarding the incident.