CORRECTION: Snowflake says it wasn't to blame for Ticketmaster breach — and its security pals agree

 

Update 6/1/24: Hudson Rock has taken down their report that a hacker breached Snowflake to steal the data, shedding doubt on the hacker’s claims.

Snowflake says it wasn't to blame for Ticketmaster breach — and its security pals agree

News

By Sead Fadilpašić

 published 3 hours ago

Mandiant and Crowdstrike are backing Snowflake up on this one

 
 
 
 

(Image credit: Future)

Snowflake has claimed it isn't to blame for the major data breach that hit Ticketmaster, despite the company blaming it for security weaknesses.
Earlier this week, the ticket sales and distribution company reported a data breach in which sensitive information on more than 500 million users were allegedly stolen.
Filing a data breach form with the SEC, Ticketmaster said that it “identified unauthorized activity within a third-party cloud database environment containing company data" - which an unnamed spokesperson later said related to Snowflake.
No evidence
Now, that company is denying these claims, and has brought two cybersecurity companies to back them up.

In a forum thread posted on June 2, Snowflake representatives said an preliminary investigation, conducted by both CrowdStrike and Mandiant, suggested this was a credential stuffing attack, and not a system vulnerability being exploited:

“Our key preliminary findings identified to date:

• we have not identified evidence suggesting this activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform; 
• we have not identified evidence suggesting this activity was caused by compromised credentials of current or former Snowflake personnel;
• this appears to be a targeted campaign directed at users with single-factor authentication;
• as part of this campaign, threat actors have leveraged credentials previously purchased or obtained through infostealing malware,” the announcement reads.

However, the researchers did find that one of the compromised accounts belonged to a former Snowflake employee. This was a demo account, and as such, did not contain sensitive data, or was able to grant access to such data.
“Demo accounts are not connected to Snowflake’s production or corporate systems,” the announcement concluded. 

“The access was possible because the demo account was not behind Okta or Multi-Factor Authentication (MFA), unlike Snowflake’s corporate and production systems.”