Snowflake enforces MFA as data breach probe continues

Cloud data analytics platform Snowflake announced that it will enforce multi-factor authentication following what might be one of the largest data breaches on record.

This decision was prompted by a breach noticed last month by Hudson Rock analysts, involving a massive data theft from Ticketmaster, Spanish bank Santander, and potentially hundreds of millions of files from Advance Auto Parts—all of whom are Snowflake clients.

Snowflake, a platform that hosts massive datasets for corporations, revealed that hackers had been using stolen credentials to try to infiltrate its customer accounts.

Despite Snowflake launching legal actions against Hudson Rock, forcing them to withdraw their report, the company acknowledged that it was investigating “a targeted threat campaign against some Snowflake customer accounts.” At the same time, TechCrunch reported the discovery of a trove of Snowflake customer passwords online, available to hackers. Snowflake had at first signaled that only a “limited” number of customer accounts were compromised.

However, the news outlet reported that LendingTree’s subsidiary, QuoteWizard, also suffered a data breach at Snowflake. “We can confirm that we use Snowflake for our business operations, and that we were notified by them that our subsidiary, QuoteWizard, may have had data impacted by this incident,” a spokesperson stated.

Much of the drama involving Snowflake has unfolded on BreachForums, a well-known cybercrime marketplace. This site was shut down by the FBI in mid-May, only to be replaced by a new version. This iteration is allegedly managed by the hacker group ShinyHunters, who claim they are trading 560 million records from Ticketmaster and 30 million from Santander.

Both organizations have acknowledged these data breaches. Ticketmaster has specifically attributed its breach to Snowflake, whereas Santander has reported unauthorized access to a database managed by a third-party provider, without confirming the extent of the breach.

Recently, a BreachForums group with the username Sp1d3r has spotted two additional companies affected by the Snowflake incident. According to Sp1d3r, they have 3TB worth of data for 380 million customers from Advance Auto Parts and information in regards to 190 million customers from financial services firm LendingTree and its subsidiary QuoteWizard. BleepingComputer has verified the customer data related to Advance Auto Parts.