Mandiant says hackers stole a ‘significant volume of data’ from Snowflake customers

Mandiant and Snowflake are investigating an ongoing campaign by a financially motivated cybercriminal group (UNC5537) that has used stolen credentials—largely harvested via infostealer malware infections—to access and exfiltrate data from hundreds of Snowflake customer accounts since at least mid-April; approximately 165 customers have been notified, with confirmed victims including Ticketmaster and LendingTree, and the campaign includes extortion demands while Snowflake has not yet enforced MFA or reset affected credentials.