Massive Ticketmaster, Santander data breaches linked to Snowflake cloud storage
Photo by Amelia Holowaty Krales / The Verge
An alleged data breach potentially affecting as many as 560 million Ticketmaster accounts and a confirmed one for Santander Bank may have stemmed from attacks on the cloud storage accounts with a company called Snowflake. As spotted by Bleeping Computer, an investigation from cybersecurity firm Hudson Rock reports that a bad actor gained access to Ticketmaster and Santander by using the stolen credentials of a single Snowflake employee.
According to Hudson Rock, the hacker bypassed the authentication service Okta using these credentials and then generated session tokens to obtain a trove of information from Snowflake. In addition to Ticketmaster and Santander Bank, Hudson Rock suggests the hacker may have gained access to hundreds of other Snowflake customers. A few of the major brands that use the cloud storage service include AT&T, HP, Instacart, DoorDash, NBCUniversal, and Mastercard.
Today we spoke with multiple individuals privy to and involved in the alleged TicketMaster breach.Sometime in April an unidentified Threat Group was able to get access to TicketMaster AWS instances by pivoting from a Managed Service Provider. The TicketMaster breach was not…— vx-underground (@vxunderground) May 30, 2024
The threat actor involved appears to be a hacking group called ShinyHunters, which attempted to sell Ticketmaster’s data on the dark web for $500,000, according to Bleeping Computer. ShinyHunters also claimed responsibility for the Santander breach and put information said to belong to over 30 million customers up for sale.
Snowflake has seemingly disputed Hudson Rock’s findings in its most recent response, saying that while investigating “potentially unauthorized access to certain customer accounts,” it “observed increased threat activity beginning mid-April 2024 from a subset of IP addresses and suspicious clients we believe are related to unauthorized access.”
More details on those findings are available here, but the company says that while a bad actor accessed a “demo account” belonging to a former employee, it didn’t contain sensitive information. It claims that “To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product.”
Ticketmaster still has yet to confirm any breach, but malware tracker vx-underground says it can assert “with a high degree of confidence” that the leaked data is legitimate. It notes that some of the leaked information dates back to the mid-2000s and includes full names, emails, addresses, phone numbers, hashed credit card numbers, and more.
Earlier this month, Santander published a statement to confirm that “certain information” of customers in Chile, Spain, and Uruguay had been accessed. The Verge reached out to Ticketmaster and Santander with requests for comment but didn’t immediately hear back.
Photo by Amelia Holowaty Krales / The Verge
An alleged data breach potentially affecting as many as 560 million Ticketmaster accounts and a confirmed one for Santander Bank may have stemmed from attacks on the cloud storage accounts with a company called Snowflake. As spotted by Bleeping Computer, an investigation from cybersecurity firm Hudson Rock reports that a bad actor gained access to Ticketmaster and Santander by using the stolen credentials of a single Snowflake employee.
According to Hudson Rock, the hacker bypassed the authentication service Okta using these credentials and then generated session tokens to obtain a trove of information from Snowflake. In addition to Ticketmaster and Santander Bank, Hudson Rock suggests the hacker may have gained access to hundreds of other Snowflake customers. A few of the major brands that use the cloud storage service include AT&T, HP, Instacart, DoorDash, NBCUniversal, and Mastercard.
Today we spoke with multiple individuals privy to and involved in the alleged TicketMaster breach.
Sometime in April an unidentified Threat Group was able to get access to TicketMaster AWS instances by pivoting from a Managed Service Provider. The TicketMaster breach was not…
— vx-underground (@vxunderground) May 30, 2024
The threat actor involved appears to be a hacking group called ShinyHunters, which attempted to sell Ticketmaster’s data on the dark web for $500,000, according to Bleeping Computer. ShinyHunters also claimed responsibility for the Santander breach and put information said to belong to over 30 million customers up for sale.
Snowflake has seemingly disputed Hudson Rock’s findings in its most recent response, saying that while investigating “potentially unauthorized access to certain customer accounts,” it “observed increased threat activity beginning mid-April 2024 from a subset of IP addresses and suspicious clients we believe are related to unauthorized access.”
More details on those findings are available here, but the company says that while a bad actor accessed a “demo account” belonging to a former employee, it didn’t contain sensitive information. It claims that “To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product.”
Ticketmaster still has yet to confirm any breach, but malware tracker vx-underground says it can assert “with a high degree of confidence” that the leaked data is legitimate. It notes that some of the leaked information dates back to the mid-2000s and includes full names, emails, addresses, phone numbers, hashed credit card numbers, and more.
Earlier this month, Santander published a statement to confirm that “certain information” of customers in Chile, Spain, and Uruguay had been accessed. The Verge reached out to Ticketmaster and Santander with requests for comment but didn’t immediately hear back.