Hundreds of Snowflake customer passwords found online are linked to info-stealing malware

A TechCrunch investigation details alleged compromises of multiple Snowflake customer accounts where infostealer malware reportedly stole employee Snowflake credentials (username/password and custom login URLs). Attackers published hundreds of credentials tied to organizations including Ticketmaster and Santander; lack of enforced MFA on customer accounts is presented as the primary enabler. Snowflake acknowledges potential unauthorized access to a limited number of accounts, urges customers to enable MFA, and says it has found no evidence of a direct breach of Snowflake infrastructure, while investigators did not test credentials directly.