{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T23:39:04.690Z",
  "tag": {
    "id": "ticketmaster",
    "label": "Ticketmaster",
    "isStack": false,
    "url": "https://pwn.watch/t/ticketmaster",
    "feed": "https://pwn.watch/t/ticketmaster/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "snowflake-customer-data-theft-unc5537",
      "title": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537",
      "json": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Snowflake customer instances",
      "tags": [
        "snowflake",
        "ticketmaster",
        "att",
        "infostealer",
        "data-breach",
        "extortion",
        "mfa"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-04-14",
      "closedAt": "2024-07-12",
      "updatedAt": "2024-07-12",
      "summary": "A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-07-12",
      "title": "AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace",
      "body": null,
      "sourceUrl": "https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-06-10",
      "title": "Mandiant publishes its UNC5537 report: about 165 organizations notified",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-31",
      "title": "Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake",
      "body": null,
      "sourceUrl": "https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-30",
      "title": "Snowflake publishes detection and hardening guidance",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-22",
      "title": "Mandiant alerts Snowflake to a broader campaign and starts notifying victims",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-20",
      "title": "Live Nation identifies unauthorized activity in a third-party cloud database",
      "body": null,
      "sourceUrl": "https://investors.livenationentertainment.com/sec-filings/all-sec-filings/content/0001335258-24-000081/0001335258-24-000081.pdf",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-14",
      "title": "Earliest attacker DBeaver login shown in Mandiant's sample logs; AT&T later said its data was downloaded in April",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    }
  ]
}