Qubole Supply Chain Attack Hits Over a Dozen AWS Customers

· Cybersecurity · United States

A threat actor used compromised identity and access management (IAM) credentials tied to Qubole's AWS account to break into and exfiltrate data from multiple customers' AWS environments, with over a dozen organizations reported hit. Attackers stole customer files, secrets, keys, environment variables and credentials across the affected accounts. In a related incident, cloud hosting provider Railway said hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces. Together the cases highlight how trusted cloud access paths—IAM keys and platform vulnerabilities—can be abused at scale for data theft and financial fraud.

Why it matters：Abuse of trusted IAM credentials and platform flaws shows that supply-chain and cloud-identity risk now extends beyond the breached vendor to every customer who trusted it.

Key points

  • Compromised Qubole IAM credentials enabled data theft from customer AWS environments.
  • Stolen data included files, secrets, keys and environment variables.
  • Railway separately reported about $740,000 in fraudulent AI charges and up to 100,000 workspaces potentially exposed.

Sources (original reporting)

More stories from this day