Qubole · Breach

[Single source] Attackers used Qubole trusted AWS account to breach customers

Nov 09, 2026 · 1 min read

Attackers used credentials for Qubole's trusted AWS account to breach multiple customers' AWS accounts. They stole AWS and identity provider credentials, extracted secrets, and copied S3 data. Qubole customers should review account access and rotate exposed credentials.

By HIFY Radar newsroom Updated 11/09/2026 03:04 PM Get this every day →← Back to the feed 2 sources

HighBreachNo software to update

In 30 seconds

Observed

Cloud security company Wiz disclosed that an attacker broke into AWS accounts belonging to multiple customers of Qubole, a data lake platform owned by Idera, between October 14 and October 26, 2026.

Alleged

The attacker allegedly used credentials for an AWS account that Qubole's platform uses to reach those customers, stealing stored secrets and data: including AWS and identity provider credentials: and copying S3 data. How the attacker obtained those credentials has not been disclosed.

What happened

Observed

Wiz reported on November 9, 2026 that an attacker broke into AWS accounts belonging to multiple Qubole customers during a window from October 14 to October 26, 2026, and stole stored secrets and data.

Observed

The intrusion path was credentials for an AWS account that Qubole's platform uses to reach those customers. The reporting notes that how the attacker got those credentials has not been disclosed.

Alleged

According to The Hacker News' summary, the attackers stole AWS and identity provider credentials, extracted secrets, and copied data from Amazon S3 inside the affected accounts.

Why it matters

Inferred

The incident illustrates how trusted cross-account access between a SaaS provider and its customers can become a breach path: once the attacker held credentials for Qubole's platform account, the existing trust relationship appears to have opened the door to multiple customer environments at once.

Inferred

The reported theft of AWS and identity provider credentials, secrets, and S3 data suggests potential for follow-on access and data exposure across every environment reachable through that trust, beyond the initial October 14–26 intrusion window.

What to do

Observed

The Hacker News' post on X directs readers to its article for 'how the attacks worked and what to check'; the specific guidance is not included in the material captured here.

Inferred

Given the reported vector, customers of platforms that hold trusted access to their AWS accounts: Qubole users in particular: would reasonably review the scope of those cross-account trust relationships, audit their AWS access logs for the October 14–26 window, and rotate credentials and secrets the platform could reach. These steps are inferred from the reported attack path, not from published official guidance in this batch.

Confirmed and still uncertain

Observed

Known: the intrusion window (October 14–26, 2026); the target (AWS accounts of multiple Qubole customers); the vector (credentials for the AWS account Qubole's platform uses to reach customers); and the reported impact (stolen stored secrets and data, including AWS and identity provider credentials, and copied S3 data). Qubole is a data lake platform owned by Idera, and the findings come from cloud security company Wiz.

Observed

Unknown: how the attacker obtained the credentials for Qubole's trusted AWS account: the reporting explicitly states this has not been disclosed. The number of affected customers and the total scope of stolen data are also not specified in the captured material.

What people are saying

Alleged

Wiz, the cloud security company that disclosed the incident, says an attacker used credentials for Qubole's platform AWS account to breach multiple customers' AWS accounts and steal stored secrets and data; these attribution and impact claims originate from Wiz as relayed by The Hacker News.

Observed

The Hacker News summarized the incident on X, stating that attackers 'stole AWS and identity provider credentials, extracted secrets, and copied S3 data' using credentials for Qubole's trusted AWS account, and pointed followers to its article for what to check.

Evolution

Observed

The intrusion activity occurred between October 14 and October 26, 2026, according to Wiz; the public disclosure came on November 9, 2026, when Wiz's findings were reported by The Hacker News and shared via its X account shortly after.

Observed

As of publication, no details had been released on how the attacker obtained the Qubole account credentials, leaving the initial-compromise question open.

Reach

Observed

1 independent groups, 2 updates, and 0 engagements.

Technical detail

Observed

The attack targeted Qubole's integration model: Qubole's platform uses a dedicated AWS account to reach customer accounts, and the attacker wielded credentials for that account. Within customer environments, the attackers reportedly stole AWS and identity provider credentials, extracted secrets, and copied S3 data.

Inferred

This pattern is consistent with cross-account IAM trust abuse, in which a compromised vendor account inherits whatever permissions customers granted it; however, the captured material does not specify the IAM roles, permissions, or exact techniques involved, nor does it name the identity providers whose credentials were stolen.

Sources and evidence

Observed

This brief draws on two items: The Hacker News article 'Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data' (primary source, published November 9, 2026) and a related post from @TheHackersNews on X (discussion source, published within roughly a minute of the article).

Observed

The captured article text appears truncated, cutting off mid-sentence while introducing Qubole ('Qubole, a data lake platform owned by Idera,'), so details such as attack mechanics, indicators of compromise, and remediation steps that may appear in the full article are unavailable in this batch. No independent statements from Qubole, Idera, AWS, Wiz's original post, or affected customers are included, and the attacker-action details remain single-outlet claims attributed to Wiz.