Risk & Repeat: Sorting out Snowflake's security mess

## Overview

This podcast episode discusses the Snowflake security incident that emerged in late May. Snowflake is a major cloud-focused storage and analytics database vendor. The incident involves reports of threat actors compromising Snowflake customers through stolen credentials, with significant media coverage and disputed claims about the root cause and scope.

## Timeline and Key Events

At the end of May, security vendor Mandiant reported that a threat actor group called UNC5537 was conducting data extortion attacks against Snowflake database customers using stolen credentials. Snowflake initially stated there was no evidence of a vulnerability or breach of its platform itself. By June 1st, Snowflake, CrowdStrike, and Mandiant issued a joint statement concluding there was no evidence of a platform vulnerability or breach, characterizing the attacks as targeting customers with single-factor authentication (passwords only) using compromised credentials.

However, threat intelligence vendor Hudson Rock claimed on May 30th that Snowflake had suffered a "massive breach" and suggested it was a supply chain attack affecting hundreds of customers, including Ticket Master. This report spread rapidly through media and security communities. Snowflake subsequently disputed Hudson Rock's claims. Hudson Rock's blog post was taken down, and the vendor later stated they had received a legal demand from Snowflake requesting its removal.

## Technical Details

The hosts clarify several key points:

- Attacks involved stolen credentials obtained either from dark web markets or through information-stealing malware, not from exploiting a Snowflake platform vulnerability - Affected customers primarily lacked multi-factor authentication (MFA) enabled, allowing credential-based access - Snowflake's statement was carefully worded: their "platform" was not breached, but this narrower claim does not rule out compromises of customer environments - One former or current employee's demo account was compromised, though details about timing and scope remain unclear - While Ticket Master disclosed a breach through a third-party cloud resource, this didn't definitively prove a Snowflake supply chain attack

## Analysis and Skepticism

The hosts discuss a broader theme: deep skepticism about statements from both threat actors and corporations. Key observations:

- Threat actors have financial and reputational motivations to deceive and cannot be trusted without independent verification - Major incident response firms like Mandiant and CrowdStrike lending their reputations to Snowflake's statement carries significant weight, yet skeptics question whether they are providing carefully parsed legal language that omits damaging details - Recent incidents (e.g., Microsoft breaches, Uber's public deception about a breach) have bred legitimate media skepticism about vendor transparency - The hosts note that screenshots and even CSV files provided by threat actors are difficult to verify independently - Some security experts questioned specific wording in Snowflake's statement, suggesting room remained for an incident to have occurred despite the denial

## Shared Responsibility and Accountability

The hosts acknowledge that Snowflake customers bear some responsibility for enabling MFA, yet they note Snowflake could have done more—such as mandating MFA by default or making solutions like Duo easier to implement. This raises questions about vendor responsibility in cloud security.

## Takeaways

1. **Trust metrics matter**: Neither threat actors nor corporations deserve unconditional trust; skepticism is warranted for both 2. **Language precision is critical**: Carefully worded statements like "our platform wasn't breached" differ meaningfully from "no breach occurred" 3. **Media literacy is improving**: The security community's skepticism about corporate statements, while sometimes cynical, reflects awareness of past corporate deception 4. **Legal action by companies is unpopular but expected**: Snowflake's apparent legal demand to Hudson Rock was controversial but unsurprising given the stakes 5. **The story is ongoing**: The hosts emphasize that conclusions could change as more information emerges

The incident illustrates how cloud security incidents blur lines between vendor responsibility and customer negligence, and how trust in corporate statements—and threat actor claims—has eroded due to recent industry history.