Pure Storage confirms data breach after Snowflake account hack

Pure Storage confirmed a breach of a Snowflake analytics workspace that exposed telemetry data and customer identifiers; Snowflake, Mandiant, and CrowdStrike link a wider campaign (tracked as UNC5537) to the use of credentials harvested by multiple infostealer malware families (Vidar, RedLine, Racoon, RisePro, Lumm, Metastealer). The campaign exploits accounts without MFA or network allowlists, has led to hundreds of compromised Snowflake credentials and notifications to ~165 organizations, and has resulted in large-scale data exfiltration and extortion, including multiple high-profile breaches and datasets being sold.