A single set of stolen credentials allowed an attacker to breach more than a dozen organizations simultaneously by exploiting trusted vendor roles that remained active long after they were no longer needed. The attacker used these credentials to quietly pull production database backups and customer profile files from multiple companies, bypassing standard security checks because the access appeared legitimate in system logs.
This image illustrates the core concept of the breach: how one set of stolen credentials allowed an attacker to reach multiple organizations.
The Mechanism of Forgotten Trust
The breach occurred because many companies maintained active cloud roles for Qubole even after they had stopped using the platform. These 'dormant' roles were still authorized to read nearly all of the sensitive data the attacker targeted.
This image serves as the primary visual representation of the supply chain attack described in the article.
Because the organizations had set up their integrations following AWS recommendations, the attacker was able to present the correct ExternalId code. To the cloud provider, the activity appeared to be coming from Qubole itself, even though the traffic originated from a rented OVH server and a Mullvad VPN.
“When a trusted vendor is compromised, following best practice isn't enough, because the attacker's access is real and looks legitimate in every log.”
— Inside the Qubole Supply Chain Attack: How Sentra Found It
Tactics and Data Exfiltration
The attacker began with a slow testing phase on a low-value role before moving quickly to bulk download thousands of customer-profile files. They eventually pivoted to pulling production database backups from different VPN addresses to avoid detection.
To expand their reach, the attacker used several techniques to harvest more credentials, including pulling secrets in bulk from Secrets Manager, reading decrypted parameters from SSM Parameter Store, and scraping EC2 user data for startup scripts containing passwords.
Detection and Mitigation Limits
Sentra traced the attack by comparing the content of leaked files to their own data maps, eventually narrowing the scope to a handful of S3 buckets. They identified Qubole as the only external identity with the permissions to reach those specific buckets while exhibiting anomalous behavior.
A significant limitation in cloud security is that many storage systems do not record every file read by default. While encryption logs and file access logs provided some evidence, the actual volume of stolen data may be higher than what was captured in the logs.
The incident demonstrates that following best practices is insufficient against supply chain attacks if those practices allow for standing access. Mitigation requires a 'Zero Trust' approach to shrink vendor permissions to only what is needed today and Data Detection and Response (DDR) to flag when a trusted identity behaves like an attacker.