Hackers Leverage Compromised Qubole IAM Credentials to Access and Exfiltrate Data from Multiple AWS Customers

What happened

Attackers compromised two Qubole IAM users, used AWS AssumeRole to access customer accounts, enumerated S3 buckets, harvested secrets, and exfiltrated data from multiple AWS environments.

Why it matters for trust and compliance

• The incident demonstrates why continuous verification of cross‑account trust policies and least‑privilege IAM controls are essential for audit readiness.
• Map cross‑account role trust policies to a control objective for identity governance.
• Collect CloudTrail evidence of role assumption to support audit trails and continuous monitoring.

Who is affected

Recommended actions

1. Review CloudTrail for AssumeRole events from the provider account and revoke any suspicious sessions.
2. Rotate all secrets discovered in Secrets Manager, Parameter Store, and Lambda environments.
3. Restrict cross‑account role permissions to least‑privilege and add source‑IP or MFA conditions.