Snowflake ends service-account passwords. Now comes the hard part

The report details a large credential-based compromise in which Connor Moucka and co-conspirators used valid, often years-old credentials to access over 165 Snowflake customer accounts and exfiltrate billions of records (including AT&T call/text logs). It reviews Snowflake’s phased deprecation of passworded legacy service accounts, outlines operational remediation steps—inventorying service accounts, assigning named owners, selecting per-account passwordless methods, and treating replaced passwords as compromised—and highlights governance failures that enable such large-scale breaches.