Snowflake customer-account credential-stuffing campaign (UNC5537, 2024)

Across mid-2024, a single threat cluster tracked variously as UNC5537 and ShinyHunters ran one of the most consequential SaaS-credential campaigns ever publicly documented: roughly 160 Snowflake customer tenants were logged into using stolen credentials, exposing data on hundreds of millions of consumers across Ticketmaster, Santander, AT&T, LendingTree, Advance Auto Parts, Neiman Marcus, Bausch Health, and others.

What happened

Snowflake is a cloud data-warehouse platform — most large enterprises store some of their most concentrated analytical data there. UNC5537 did not exploit a Snowflake product vulnerability. Instead, the group:

1. Harvested credentials at scale from contractor and employee endpoints already infected with infostealer malware (Lumma, Redline, Vidar, Raccoon).
2. Identified Snowflake-tenant logins in the harvested credential dumps.
3. Logged in directly to tenants that did not enforce MFA on user accounts.

Once in, the attackers exfiltrated the customer's data tables and used the haul to extort the tenant — first privately, then publicly on extortion forums and ShinyHunters' leak channels.

Santander disclosed the breach on 30 May 2024: staff and 30 million customers across Spain, Chile, and Uruguay affected. Ticketmaster/Live Nation disclosed the next day: data on approximately 560 million users. AT&T's separately disclosed Snowflake exposure (call/text metadata for ~110M wireless customers across six months of 2022) is also part of this campaign.

Snowflake publicly stated that this was not a product compromise but a customer-credential issue — while also disclosing that a former Snowflake employee's account had been accessed by attackers, complicating the narrative. The company later moved to require MFA by default on customer tenants in response.

Impact

• Approximately 160 Snowflake customer tenants breached.
• ~560 million Ticketmaster user records exposed.
• ~30 million Santander customer records exposed across three countries.
• ~110 million AT&T wireless-customer metadata records exposed (separately disclosed).
• ShinyHunters extorted multiple victims; some paid, some did not.

Why it matters

UNC5537 demonstrated, at industrial scale, that the credential layer is the new perimeter for SaaS data warehouses — and that a customer's failure to enforce MFA can compromise hundreds of millions of consumers downstream. Snowflake's subsequent decision to enforce MFA by default is now widely regarded as the post-incident standard for SaaS platforms holding concentrated customer data.