Snowflake Account Attacks Driven by Exposed Legitimate Credentials

A financially motivated actor (UNC5537) exploited exposed and stolen credentials—often obtained via infostealer malware or dark‑web sales—to access Snowflake customer accounts that lacked MFA and network allow lists, leading to data exfiltration from roughly 165 companies and the sale/extortion of that data; the report emphasizes enabling MFA, rotating credentials, and monitoring for targeted campaigns as primary mitigations.