Snowflake customer data breach via stolen credentials — 165+ organisations affected
Date: 2024-05
Affected: 165+ Snowflake customers including AT&T, Ticketmaster, Santander — AI/ML data pipelines
Attack vector: auth-bypass
Category: real-world
Severity: Critical

Attackers used credentials stolen via infostealer malware to access Snowflake customer environments containing AI training data, ML feature stores, and analytics pipelines. Over 165 organisations were affected including AT&T (110M records), Ticketmaster (560M records), and Santander. Many victims used Snowflake for AI/ML data pipelines, exposing training datasets, feature stores, and model metadata. The breach highlighted the risk of centralised data platforms for AI workloads without MFA enforcement.

Impact: Hundreds of millions of records exposed; training data compromise; regulatory investigations in multiple jurisdictions

Mitigations:
Mandatory MFA on all data platform accounts, especially those with AI/ML data access
Credential monitoring and session anomaly detection
Data classification and access controls for AI training data
Third-party data platform security assessment and continuous monitoring

Architectural layers (MAESTRO):
label: Deployment & Infrastructure
notes: Credential theft via infostealer malware; no MFA enforced on data platform
role: origin
label: Data Operations
notes: AI training data, feature stores, and model metadata exposed
role: impact
label: Agent Ecosystem
notes: Third-party data platform compromise cascades to all dependent AI systems
role: propagation