Risk & Repeat: AT&T's Snowflake database breached

### Overview In episode 234 of TechTarget's *Risk & Repeat* podcast, hosts Rob Wright and Alex Culafi examine the massive data breach disclosed by telecom giant AT&T stemming from attacks against Snowflake cloud database environments. The discussion covers the breach's scope, Snowflake's subsequent security updates regarding multiactor authentication (MFA), reported ransom payments by AT&T and automotive software provider CDK Global, and the broader implications for cybersecurity posture and incident response.

### Key Topics - **AT&T Data Breach**: Compromise of roughly six months of call and text records (May 1, 2022 to October 31, 2022) for nearly all cellular customers, mobile virtual network operator (MVNO) customers, and interacting landline users, plus records from January 2, 2023 for a small subset. - **The Snowflake Attack Campaign**: Campaign attributed to threat actor UNC5537 (also linked in reports to ShinyHunters), which targeted Snowflake cloud database instances lacking MFA, impacting over 150 customer organizations. - **Snowflake's Security Response**: Features enabling customer administrators to enforce and track MFA adoption, with plans to mandate MFA for new human users in the near future. - **Ransom and Extortion Payments**: Reports of AT&T paying approximately $373,000 (5.72 Bitcoin) for data deletion compared to CDK Global's reported $25 million payment (387 Bitcoin) following a disruptive ransomware attack. - **Cloud Security Responsibility**: The ongoing debate over whether cloud platforms should mandate security protections by default to protect customers from credential theft.

### Technical Details - **Vector and Attribution**: Attackers leveraged credentials harvested by infostealer malware to compromise Snowflake cloud databases that did not have MFA or two-factor authentication enabled. Threat intelligence tracking links the campaign to UNC5537 and ShinyHunters; early claims by Hudson Rock asserting an internal Snowflake breach were refuted and retracted. - **Snowflake Configuration Controls**: Snowflake introduced administrator tools to monitor and enforce MFA across existing customer user bases, though enforcement remains optional for existing accounts while slated to become mandatory for future new human users. - **Exfiltrated Telephony Metadata**: Stolen AT&T data consisted of call and text interaction logs rather than message contents, though the hosts note that interaction metadata presents significant privacy and national security risks. - **Ransom Transactions**: Wired reported AT&T paid 5.72 Bitcoin (~$373,000) to a threat-actor wallet via negotiations facilitated by an independent security researcher after an initial $1 million demand. Separately, CNN reported CDK Global paid roughly 387 Bitcoin (~$25 million) to affiliates of the BlackSuit ransomware operation on June 21.

### Takeaways - **MFA Enforcement by Default**: Relying on customers to voluntarily enable MFA leaves critical data exposed. Platforms like AWS have increasingly mandated MFA across high-privilege accounts, demonstrating the security value of enforcing safeguards by default. - **Unreliability of Data-Deletion Ransoms**: Paying threat actors to delete stolen data offers no real guarantee that copies will not be retained or used for future extortion. - **Regulatory and Legal Strategy**: Large enterprises may opt to pay relatively small extortion sums to demonstrate mitigation efforts or reduce exposure before regulatory bodies, even when criminal trustworthiness is nonexistent. - **Codification of Extortion**: Growing normalization of extortion and ransomware payments across cyber insurance, legal teams, and incident response operations risks codifying ransom payments as a routine, expensive cost of business.