# Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others) · pwn.watch > A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment. Page: https://pwn.watch/i/snowflake-customer-data-theft-unc5537 · generated 2026-10-23T03:54:42.456Z ## Status - Severity: critical · status: closed · patch: no-fix-needed - Product: Snowflake customer instances - Started: 2024-04-14 · closed: 2024-07-12 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/snowflake-customer-data-theft-unc5537/feed.xml - JSON Feed: https://pwn.watch/i/snowflake-customer-data-theft-unc5537/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json - This file: https://pwn.watch/i/snowflake-customer-data-theft-unc5537/llms.txt ## Updates (newest first) - 2024-07-12: AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace (https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/) - 2024-06-10: Mandiant publishes its UNC5537 report: about 165 organizations notified (https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) - 2024-05-31: Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake (https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/) - 2024-05-30: Snowflake publishes detection and hardening guidance (https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) - 2024-05-22: Mandiant alerts Snowflake to a broader campaign and starts notifying victims (https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) - 2024-05-20: Live Nation identifies unauthorized activity in a third-party cloud database (https://investors.livenationentertainment.com/sec-filings/all-sec-filings/content/0001335258-24-000081/0001335258-24-000081.pdf) - 2024-04-14: Earliest attacker DBeaver login shown in Mandiant's sample logs; AT&T later said its data was downloaded in April (https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) ## Fix brief # Security brief: Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others) Source: https://pwn.watch/i/snowflake-customer-data-theft-unc5537 · status: closed (closed Jul 12, 2024) · severity: critical · updated Jul 12, 2024 ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment. Severity detail: Mass data theft and extortion across ~165 organizations - Product: Snowflake customer instances ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Jul 12, 2024: AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace - Jun 10, 2024: Mandiant publishes its UNC5537 report: about 165 organizations notified - May 31, 2024: Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake - May 30, 2024: Snowflake publishes detection and hardening guidance - May 22, 2024: Mandiant alerts Snowflake to a broader campaign and starts notifying victims - May 20, 2024: Live Nation identifies unauthorized activity in a third-party cloud database - Apr 14, 2024: Earliest attacker DBeaver login shown in Mandiant's sample logs; AT&T later said its data was downloaded in April ## Advisories - [Detecting and preventing unauthorized user access](https://community.snowflake.com/s/question/0D5VI00000Emyl00AB/detecting-and-preventing-unauthorized-user-access) (Snowflake) ## Write-ups & news - [UNC5537 targets Snowflake customer instances for data theft and extortion](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) - [Live Nation Entertainment Form 8-K](https://investors.livenationentertainment.com/sec-filings/all-sec-filings/content/0001335258-24-000081/0001335258-24-000081.pdf) - [Live Nation confirms Ticketmaster was hacked](https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/) - [Nearly all AT&T subscribers' call records stolen in Snowflake cloud hack](https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/) --- Machine-readable: https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.