Between February and October 2024, Connor Riley Moucka and an accomplice accessed Snowflake customer accounts lacking MFA by using stolen usernames and passwords obtained through infostealer malware. They extracted valuable information from cloud storage instances using custom software and stole data from at least 165 organizations, affecting over 100 million individuals. The stolen data included call/text history, banking information, payroll records, government registration numbers, and various forms of personally identifiable information. The attackers extorted victims for millions of dollars in bitcoin and sold stolen data on hacker forums. Following these breaches, Snowflake mandated MFA and minimum 14-character passwords for all accounts.

The unauthorized access led to the theft of sensitive data from hundreds of millions of individuals and caused financial losses exceeding $9.5 million to victim companies. The attackers successfully extorted at least $2.5 million in bitcoin and obtained additional funds through selling stolen data. The breach exposed critical personal and financial information, increasing the risk of identity theft and further extortion. The attacks also included re-extortion attempts targeting government officers using stolen data.

Snowflake has implemented mandatory multi-factor authentication and requires passwords to be at least 14 characters long to prevent unauthorized access via stolen credentials. Organizations using Snowflake should ensure MFA is enabled on all accounts and enforce strong password policies. Since the attacks exploited accounts without MFA, enabling MFA is a critical defense. No additional vendor advisories or patches are indicated; the vendor manages remediation through these security policy changes.