Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign

Mandiant and Snowflake are investigating a financially motivated campaign (UNC5537) that has used stolen credentials—often acquired via information-stealer malware—to access customer Snowflake instances, run reconnaissance (via a utility dubbed FROSTBITE and legitimate tools like DBeaver), exfiltrate data, and attempt extortion; up to 165 customers have been potentially exposed and the activity highlights widespread credential exposure and lack of MFA/network controls.