Attackers use Qubole's AWS account to get into customers' AWS through their Qubole integration roles, stealing secrets and downloading S3 buckets (Wiz, Sentra, Mandiant)

From 14 to 26 Oct 2026 an attacker used IAM user credentials from a Qubole-associated AWS account (805246085872) to assume the cross-account integration roles customers created for Qubole (the External ID check passed). Inside, it listed S3, EC2, RDS, Glue, IAM and KMS, read Lambda environment variables, Secrets Manager secrets and SSM parameters, checked the stolen AWS, Entra ID and Okta credentials with TruffleHog, and downloaded whole S3 buckets. Wiz saw several victim AWS environments, and Sentra saw it across several of its customers; victims are not named and the count is unknown. Separately, on 8-11 Oct, customer-owned AWS access keys made for Qubole integrations were all tested within an hour, and a few environments were compromised; Wiz has not tied this to the main activity. How the attacker got Qubole's credentials, and whether Qubole has confirmed, are unknown.