Snowflake Rolls Out Mandatory MFA Plan

Snowflake announced a mandatory multi-factor authentication (MFA) policy requiring customers to enable MFA by November 2025, with a three-phase rollout starting with enrollment prompts in April, enforcement for password-based sign-ins in August, and blocking single-factor password sign-ins (including service accounts) in the final phase. The change follows widespread credential-based attacks earlier in the year that impacted over 165 organizations (including Neiman Marcus, Ticketmaster, and AT&T), led to significant customer data theft and subsequent extortion attempts; Snowflake published migration guides and a Threat Intelligence scanner to help identify users lacking MFA.