Compromised Qubole AWS Credentials Used to Breach Multiple Customer Cloud Environments

What happened

According to BleepingComputer, a threat actor obtained compromised identity and access management (IAM) credentials belonging to the Qubole big data platform's AWS account and used them to access and exfiltrate data from multiple customers' AWS environments. Details on the initial access vector for the Qubole credentials themselves have not been disclosed.

Why it matters for defenders

This is a supply-chain-style exposure: the attacker didn't breach each victim directly, but instead abused a trusted third-party vendor's privileged access into customer cloud accounts. Any organization that granted Qubole (or similar SaaS/data-platform vendors) IAM roles or cross-account access into its AWS environment is potentially in scope. The blast radius of a single vendor credential compromise can extend across every customer that trusted it, which is what makes third-party IAM relationships a high-leverage target.

What defenders should watch for or do now

• Inventory all third-party IAM roles, cross-account trust policies, and external access keys granted to vendors like Qubole, and confirm they follow least-privilege scoping.
• Review CloudTrail for unusual API activity (especially data access/exfiltration actions such as GetObject, ListBuckets, or large data transfers) originating from known vendor role ARNs or external account IDs.
• Look for anomalous AssumeRole activity, new access key creation, or logins from unfamiliar IP ranges/geographies tied to vendor-linked IAM principals.
• Consider enforcing external ID requirements, session duration limits, and conditional access (IP/MFA) on any cross-account roles granted to SaaS vendors.
• Reach out to Qubole/vendor contacts to confirm whether your account's integration was affected and rotate any associated credentials as a precaution.

Developing story

This is a net-new, developing report without an associated CVE, and full technical details (root cause of the Qubole credential compromise, scope of affected customers) have not yet been published. We'll monitor for updates. Read the original report at BleepingComputer.