Wiz: Stolen Qubole credentials opened customer AWS accounts to data theft

That safeguard was present. Wiz says every role-assumption request it attributed to the attacker included an External ID and succeeded. The attacker possessed what was needed to satisfy the existing trust policies; the findings do not establish a bypass of the External ID check.

AWS recommends roles with External IDs to address the “confused deputy” problem, in which another customer tricks a trusted intermediary into accessing someone else’s resources. This campaign illustrates a different exposure: credentials associated with the intermediary itself were compromised. Wiz cautions that an External ID is not a secret: it appears in plaintext in CloudTrail logs and may also be stored by the vendor.

AWS said its services were not compromised and operated as designed, according to a statement included in the reporting. It described the activity as third-party credentials being used to assume roles customers had configured to trust that provider.

Qubole’s documentation shows the trusted-account, External ID and role ARN fields used to configure IAM access. Example identifiers are obscured in the original. Source: Security Point Break.

Read access reached both files and more credentials

Wiz traced the first suspicious role assumptions to October 14, with requests from Mullvad VPN infrastructure. Subsequent activity also used an OVH-hosted server. A second IAM user associated with the same Qubole account appeared in the attacker’s activity from October 18. Legitimate Qubole platform traffic observed by the investigators came from AWS infrastructure.

After entering customer accounts, the attacker mapped storage, compute, databases and identities, then retrieved secrets from Lambda function configurations, Secrets Manager and Systems Manager Parameter Store. Sentra also describes reads of EC2 startup scripts containing credentials.

Wiz says the attacker used TruffleHog, a secrets-scanning tool, to validate credentials belonging to victim organizations, including AWS keys, service-principal secrets for Microsoft’s Entra ID identity system, and client credentials for identity provider Okta. As coverage of its findings explains, these were credentials discovered inside the customer environments. Wiz observed Entra ID service-principal sign-ins and requests for Okta OAuth tokens; the findings do not establish what further access followed those tests.

The assumed roles also allowed downloads from Amazon S3 object storage. Wiz describes opportunistic collection from whatever buckets a role could reach, including entire buckets downloaded in individual sessions.

Sentra’s account of the breaches reports about 100 passwords and keys read in seven minutes, alongside thousands of credential records in downloaded files. File-access logs across one customer’s accounts showed millions of files downloaded; Sentra also describes theft of production database backups. Those observations describe particular investigated activity, rather than a measured total for the whole campaign. Sentra says it observed no write actions: the activity it described stole data without changing or deleting it.

Sentra says its investigation began by matching leaked file samples against customer data it had already scanned. It narrowed the source to a handful of S3 buckets, identified external identities able to reach them and compared their activity with their histories. Qubole’s dormant access stood out. To reconstruct downloads, the company says it correlated encryption-related records with attacker sessions and checked those against file-access logs where available. This supplied evidence of theft beyond simply showing that a role could read the data.

Campaign-wide scale remains imprecise. Sentra uses both “more than a dozen organizations” and “dozens of Qubole customers” in its account. Wiz declined to provide an affected-organization count in responses to questions. The available evidence supports a campaign spanning multiple organizations, but provides no exact, reconciled victim total or aggregate volume of stolen data.

Company-reported milestones from Wiz’s October 2026 investigation. The separate October 8–11 activity is excluded because investigators could not link it to this campaign. Source: Wiz.

The investigation has clear limits

The published findings do not explain how the attacker obtained Qubole’s credentials. Qubole did not respond to inquiries described in the reporting; a separate account says neither Qubole nor Idera responded by its publication time. Wiz has not linked the campaign to a known group and says it lacks direct insight into the attacker’s motivation or intended use of the data.

Wiz also found activity from October 8–11 using customer-owned AWS access keys believed to have been created for Qubole integrations. Some led to cloud compromises, but the investigators could not link that activity to the later role-assumption campaign. It should not be folded into a single established intrusion sequence.

Another discovery—a bootable Linux image hosted on the attacker’s server—suggested a possible additional capability. Wiz found no deployments and could not confirm whether or how it had been used. Its presence is not evidence that this tool ran on customer machines.

Wiz and Sentra also sell security products. Sentra’s prior scanning helped it identify the stolen data, according to its own account, but its claims about investigation speed and product effectiveness are vendor claims. It says it had already flagged an unused Qubole role with access to sensitive data before the attack. It also says every secret leaked in the activity it investigated came from permissions Qubole did not need—placing excessive permissions alongside dormant trust as a factor in the damage.

Closing access and establishing what left

Wiz recommends that organizations with Qubole integrations review CloudTrail from October 1, 2026 onward in every account containing an integration role. Its technical report and indicators distinguish malicious activity from legitimate traffic using identities, source networks and subsequent behavior. Shared VPN addresses alone are not conclusive evidence of compromise.

For compromised roles, the response extends beyond replacing a key. Wiz advises rotating every secret, parameter and Lambda environment variable the role could read, and revoking active role sessions. Credential rotation does not terminate temporary sessions already issued.

Containment also requires changes to standing access: remove unused integration roles or their vendor trust, narrow permissions for current integrations, and restrict role assumption to specific vendor identities and documented networks where supported. Wiz says source-IP restrictions would have blocked every role assumption it observed in this campaign. It recommends coordinating External ID rotation with the vendor, and calls on vendors to protect the identities customers trust, use short-lived workload credentials and publish their outbound network ranges.

Establishing the full loss may be harder. CloudTrail management events record role assumptions and bucket listings, but not the object reads constituting S3 data theft. Wiz says missing logs prevented responders from seeing which objects were read in several affected environments. S3 data events or server access logs can supply that visibility when enabled; Sentra advises preserving existing logs before they expire. The remaining questions are how Qubole’s credentials were obtained, which customer data left, and whether harvested credentials enabled further access. An absence of recorded file reads cannot resolve those questions where the necessary logging was missing.