“The earliest infostealer infection date observed associated with a credential leveraged by the threat actor dated back to November 2020.”
Snowflake called it a “limited number” of customers. Mandiant counts 165. The attackers just logged in with stolen passwords, some sitting in infostealer dumps since 2020, on accounts without multi-factor authentication. Snowflake is only now “developing a plan” to require MFA. A data warehouse holding hundreds of companies’ crown jewels left the front door optional.