Hackers Exploit Qubole AWS Access to Breach Customer Accounts

# Hackers Exploit Qubole AWS Access to Breach Customer Accounts

https://gcdradar.vercel.app/incidents/hackers-exploit-qubole-aws-access-to-breach-customer-account · AIR-2026-1841 · live

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss): Confirmed real-world data and secret theft across multiple customer cloud accounts.
- Fix status: No fix needed
- First reported: 2026-11-09 (happened 2026-10-26)
- AI role: No AI role
- Products: Qubole

## Summary

Attackers used Qubole platform AWS access credentials to breach multiple customer accounts between October 14 and October 26. The intruders stole stored secrets and data from the affected environments.

## What to do

Audit AWS IAM roles and review logs for unauthorized access originating from Qubole integration credentials.

## Latest updates

- 2026-11-09: Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data (https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html)

## Sources

- 2026-11-09 The Hacker News: Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html
- 2026-11-09 sentra.io: Supply chain attack on Qubole customers https://sentra.io/blog/breaches/inside-the-qubole-supply-chain-attack
- 2026-11-10 SecurityWeek: Over a Dozen Organizations Hit in Qubole Supply Chain Attack https://securityweek.com/over-a-dozen-organizations-hit-in-qubole-supply-chain-attack
- 2026-11-10 BleepingComputer: Hackers exploit trusted AWS access to breach multiple cloud environments https://bleepingcomputer.com/news/security/hackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.