> series: anatomy_of_a_breach —— part: 185 —— platform: snowflake —— victims: ticketmaster_560M_santander_30M_att_110M —— root_cause: no_mfa<span class="cursor-blink">_</span>_
In May-June 2024, a threat actor (tracked as UNC5537) systematically accessed Snowflake cloud data platform accounts belonging to approximately 165 organisations using credentials stolen through infostealer malware. The compromised accounts did not have multi-factor authentication enabled. The campaign yielded some of the largest data thefts of the year: Ticketmaster (approximately 560 million customer records), Santander (approximately 30 million), and — disclosed separately in July — AT&T (call and text metadata for approximately 110 million customers over a six-month period).
The credentials had been stolen by infostealer malware — Vidar, RedLine, and similar — installed on employees' personal devices or unmanaged computers. The stolen credentials were then sold on dark web marketplaces and used to log directly into Snowflake accounts that lacked MFA. Snowflake itself was not breached — the platform's own infrastructure was not compromised. The failures were entirely on the customer side: stolen credentials, no MFA, and no session monitoring. The campaign was the most consequential demonstration of the MFA imperative in the history of this series — affecting over 700 million people through a single, preventable authentication failure.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Snowflake campaign is the definitive case for MFA. Sixteen years of the Anatomy of a Breach series — 185 articles — and the single most impactful control remains multi-factor authentication. Every major breach in 2024 that involved credential compromise — Microsoft/Midnight Blizzard, Change Healthcare, and the Snowflake campaign — exploited accounts without MFA. Cyber Essentials Danzell makes MFA an auto-fail criterion because the evidence from 185 articles over sixteen years is irrefutable. Our penetration testing validates MFA enforcement. SOC in a Box monitors for credential compromise. And UK Cyber Defence provides incident response when authentication fails.
<a href="/cyber-essentials">Cyber Essentials Danzell</a> mandates MFA. <a href="/penetration-testing">Penetration testing</a> validates enforcement. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for credential theft.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call