Attackers use Qubole AWS credentials to steal customer data

First reported by Cyber Security News at · Updated · 3 sources

Compromised IAM credentials associated with Qubole allowed access to multiple customers' AWS environments through trusted roles. The activity ran from October 14 through October 26, 2026. Attackers stole secrets and downloaded Amazon S3 data, sometimes taking entire buckets in a single session, according to Cyber Security News.

  • Most assumed roles were otherwise unused, Wiz said, according to RuntimeWire.

Covered by 3 publishers within 6 hours of the first report.

Reporting3

Cyber Security News Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets · Tushar Subhra Dutta
SecurityWeek Over a Dozen Organizations Hit in Qubole Supply Chain Attack · Ionut Arghire
BleepingComputer Hackers exploit trusted AWS access to breach multiple cloud environments · Bill Toulas

Related

Attackers exploit AntiFox AI platform to steal AWS credentials
AWS launches Chile cloud region for "select customers"
AWS proceeds with data center project in Walla Walla, Washington
Amazon unveils Ring Rover Cam patrol robot and $250 indoor drone

Topics Amazon