I mentioned that Live Nation breach recently… well, Snowflake has warned its customers about hackers targeting accounts without multifactor authentication. This warning is part of an evolving story that may be connected to the Ticketmaster breach. The extent of unauthorized access and its connection to massive data breaches is still being determined. Stolen credentials remain an easy way for attackers to break into accounts, highlighting the need for MFA.
The Ticketmaster data breach, along with breaches at Santander and Advance Auto Parts, are connected to Snowflake. The threat actor responsible claims that 400 companies are impacted and aims to blackmail Snowflake into buying the data back for $20m. Snowflake is investigating a targeted threat campaign and has found evidence of unauthorized access through credentials obtained via info-stealing malware.
MFA alone should be the headline. Learning how the attackers breached the walls is the insight.