Qubole's Trusted AWS Access Exploited to Breach Customer Accounts

A supply-chain style intrusion has hit customers of Qubole, a data lake platform owned by Idera, after attackers abused credentials tied to the vendor's own AWS access. According to cloud security firm Wiz, which disclosed the incident, the attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26, 2026, and stole stored secrets and data.

The key detail is the entry point: the attacker used credentials for an AWS account that Qubole's platform relies on to reach customer environments. In other words, the compromise did not begin with a flaw in each victim's own perimeter. It began with a trusted third party holding cross-account access — a pattern that has become one of the most consequential risks in cloud computing.

What Happened

Wiz's findings describe a campaign in which the attacker gained access to a Qubole-operated AWS account and then pivoted into customer accounts using the trust relationships that platform depends on. During the intrusion window, secrets and data stored in those environments were exfiltrated. How the attacker obtained the initial Qubole credentials has not been publicly disclosed.

The absence of that detail matters for defenders. Without knowing whether the credentials were phished, leaked, stolen from a developer workstation, or harvested through a vulnerability, customers cannot easily assess whether their own configurations contributed to exposure. What is clear is that the blast radius extended beyond Qubole itself and into the environments of its customers.

Why Cross-Account Trust Is a Prime Target

Modern data platforms rarely operate in isolation. To read from customer data lakes, run jobs, and manage resources, they frequently assume roles in customer AWS accounts. Those role assumptions are governed by trust policies that, once established, can be easy to overlook and hard to audit at scale.

For attackers, this is an attractive path. A single set of compromised vendor credentials can unlock many downstream environments, and activity may blend into legitimate platform operations. Detection is further complicated when the vendor's access is broad by design — a common outcome when integrations are configured for convenience rather than least privilege.

Security teams have spent years hardening their own perimeters while third-party integrations quietly accumulated standing access. This incident is a reminder that the trust boundary of an organization now extends to every SaaS and platform provider that can assume a role inside its cloud estate.

Recommendations for Affected and At-Risk Organizations

Wiz's disclosure, and the nature of the intrusion, point to a set of practical steps for any organization that grants third-party platforms access to cloud accounts:

  • Audit cross-account roles. Review every role that trusts an external account, especially vendor-owned accounts, and confirm each is still required.
  • Enforce least privilege. Scope permissions to specific resources and actions rather than granting broad administrative or wildcard access.
  • Add external IDs and conditions. Require unique external IDs in trust policies and restrict assumption by source IP, VPC, or other conditions where supported.
  • Rotate and monitor credentials. Treat vendor access keys and role sessions as sensitive assets. Alert on unusual role assumption patterns, new regions, or spikes in data access.
  • Inventory secrets. Identify secrets stored in cloud services that a compromised role could reach, and rotate anything potentially exposed.
  • Ask vendors for assurance. Request details on how providers secure their own credentials, segment customer access, and detect anomalous use of their platform roles.

For Qubole customers specifically, the immediate priority is to determine whether their accounts were among those accessed, rotate credentials and secrets that may have been exposed, and review CloudTrail and related logs for activity during the October 14–26 window.

The Bigger Picture

This is not the first time trust relationships between a platform and its customers have been turned into an attack vector, and it will not be the last. As data platforms consolidate access across many cloud accounts, they become high-value targets whose compromise multiplies outward.

Organizations should treat third-party cloud access as part of their own attack surface: documented, minimized, monitored, and periodically re-approved. Vendors, in turn, face pressure to segment customer access so that a single credential compromise cannot cascade across their entire customer base.

Qubole, owned by Idera, has not publicly detailed the root cause of the credential compromise. Until more is known, customers should assume their environments may have been reachable and validate their exposure directly.

Source: The Hacker News