TechCapsules

AI-summarised brief · reviewed before publication

Between October 14 and 26, attackers compromised AWS accounts belonging to multiple Qubole customers, stealing stored secrets and data, according to cloud‑security firm Wiz. The breach exploited the trust relationship that Qubole’s platform establishes with customers via an IAM role that permits Qubole’s AWS account (805246085872) to assume the role using an External ID. The attackers obtained credentials for that Qubole account—method undisclosed—and successfully issued AssumeRole requests from outside AWS, gaining access to unused but still trusted roles. Once inside, they harvested environment variables, Secrets Manager entries, SSM Parameter Store values, and copied data from any S3 buckets the roles could reach, sometimes downloading entire buckets. Wiz found no link to known state‑backed campaigns and noted that both Qubole and its owner Idera have not issued statements.