As many as 165 companies ‘potentially exposed’ in Snowflake-related attacks, Mandiant says

Mandiant reports that a financially motivated group tracked as UNC5537 used credentials stolen by infostealer malware to access Snowflake customer instances that lacked multi-factor authentication or location restrictions, resulting in data exfiltration affecting dozens to potentially hundreds of organizations — including Ticketmaster and Santander — and potentially hundreds of millions of individuals; stolen datasets have appeared for sale on cybercrime forums.