4 ms·

This article is claiming that the Ticketmaster breach from a few days ago was actually a much broader hack affecting 400+ companies, all through a Snowflake emp

This article is claiming that the Ticketmaster breach from a few days ago was actually a much broader hack affecting 400+ companies, all through a Snowflake employee's stolen credentials. This seems like a pretty big story that's only being reported on hudsonrock.com now. I haven't heard of Hudson Rock before, does anyone know if they are a reputable source?

proactivesvcs 2y ago
BBC News report of a substantial hack of Santander bank; linked to Snowflake. https://www.bbc.co.uk/news/articles/c6ppv06e3n8o https://www.bbc.co.uk/news/articles/c6ppv06e3n8o
- dralley 2y ago
  BBC just linked back to Hudson Rock's allegation FWIW, they don't have any independent confirmation
- WhackyIdeas 2y ago
  Great, so these companies do not give a flying fuck about their customer data in making sure the data stored at cloud storage companies are end to end encrypted. To think these random cloud storage companies can access your bank information is utterly shocking.
  - squigz 2y ago
    > To think these random cloud storage companies can access your bank information is utterly shocking. Honestly this sort of thing shouldn't be shocking at all.
    - Johnny555 2y ago
      It’s been a while since I’ve been a Snowflake customer, but I do recall that Snowflake has a mode where the customer owns their own encryption key for their data. Snowflake employees (even admins with the highest access) have no access to the customer’s data unless the customer grants explicit access. It’d take a pretty serious breach on their compute notes to exfiltrate data. https://docs.snowflake.com/en/user-guide/security-encryption-tss https://docs.snowflake.com/en/user-guide/security-encryption...
    - oasisbob 2y ago
      Not surprised at all. Doesn't even depend on cloud vendors - I'm thinking back to the 2023 MOVEit vulnerability which resulted in the release of a ton of customer info from banks' own internal infrastructure.
  - halfcat 2y ago
    Can a tool like Snowflake work if it doesn’t have access to the unencrypted data?
    - orthecreedence 2y ago
      No. E2E encryption doesn't really apply here.
      - elvisizer 2y ago
        lol everyone in this thread is wrong about everything basically.
        dnate 2y ago
        Let them be enraged. Great time to buy more SNOW :D
ransom1538 2y ago
Snowflake employees need time to sell off all their shares. This news will hurt the SNOW stock price big.
richbell 2y ago
> I haven't heard of Hudson Rock before, does anyone know if they are a reputable source? I first learned of Hudson Rock after their "CEO" started spamming every security-related subreddit with low-effort blogspam over a period of months alleging numerous breaches. They've had several accounts banned, both by Reddit moderators and administrators. Personally, I would no consider them a reputable or reliable source.
deleted 2y ago
[deleted]

proactivesvcs 2y ago

BBC News report of a substantial hack of Santander bank; linked to Snowflake. https://www.bbc.co.uk/news/articles/c6ppv06e3n8o https://www.bbc.co.uk/news/articles/c6ppv06e3n8o

dralley 2y ago
BBC just linked back to Hudson Rock's allegation FWIW, they don't have any independent confirmation
WhackyIdeas 2y ago
Great, so these companies do not give a flying fuck about their customer data in making sure the data stored at cloud storage companies are end to end encrypted. To think these random cloud storage companies can access your bank information is utterly shocking.
- squigz 2y ago
  > To think these random cloud storage companies can access your bank information is utterly shocking. Honestly this sort of thing shouldn't be shocking at all.
  - Johnny555 2y ago
    It’s been a while since I’ve been a Snowflake customer, but I do recall that Snowflake has a mode where the customer owns their own encryption key for their data. Snowflake employees (even admins with the highest access) have no access to the customer’s data unless the customer grants explicit access. It’d take a pretty serious breach on their compute notes to exfiltrate data. https://docs.snowflake.com/en/user-guide/security-encryption-tss https://docs.snowflake.com/en/user-guide/security-encryption...
  - oasisbob 2y ago
    Not surprised at all. Doesn't even depend on cloud vendors - I'm thinking back to the 2023 MOVEit vulnerability which resulted in the release of a ton of customer info from banks' own internal infrastructure.
- halfcat 2y ago
  Can a tool like Snowflake work if it doesn’t have access to the unencrypted data?
  - orthecreedence 2y ago
    No. E2E encryption doesn't really apply here.
    - elvisizer 2y ago
      lol everyone in this thread is wrong about everything basically.
      - dnate 2y ago
        Let them be enraged. Great time to buy more SNOW :D

ransom1538 2y ago

Snowflake employees need time to sell off all their shares. This news will hurt the SNOW stock price big.

richbell 2y ago

> I haven't heard of Hudson Rock before, does anyone know if they are a reputable source? I first learned of Hudson Rock after their "CEO" started spamming every security-related subreddit with low-effort blogspam over a period of months alleging numerous breaches. They've had several accounts banned, both by Reddit moderators and administrators. Personally, I would no consider them a reputable or reliable source.

deleted 2y ago

[deleted]