Snowflake account hacks linked to Santander, Ticketmaster breaches

A threat actor claimed to have accessed and exfiltrated data from Snowflake customer accounts after stealing employee credentials via an infostealer; Hudson Rock published claims that hundreds of customer instances were affected and the actor attempted extortion. Snowflake says the activity resulted from compromised customer accounts (not a product vulnerability), has notified affected customers, and published IOCs (including a custom exfiltration tool named 'RapeFlake' and DBeaver connection indicators) while urging MFA and account hardening.