You might be misunderstanding (or I am). My reading of the situation currently is that the “real” breaches were due to actual production credentials leaking wh

You might be misunderstanding (or I am). My reading of the situation currently is that the “real” breaches were due to actual production credentials leaking which were used to actually access production. Then some customers were not using MFA on their Snowflake account so credentials were all that were needed. The demo accounts were associated with a Snowflake SE which was just one part of the attack.