Long-lived credentials Customer-account data theft
Snowflake customer accounts: old stolen passwords still worked
- Incident
- Campaign investigated in April–May 2024
- Source report
What was reported
Mandiant reported that UNC5537 used stolen credentials to access Snowflake customer instances and steal data. In the cases it investigated, affected accounts lacked multi-factor authentication; some stolen credentials remained valid for years. It found no evidence that the access resulted from compromise of Snowflake’s enterprise environment.
Our perspective
Our reading: A connection should not quietly retain indefinite authority. Expiry, credential rotation and the narrowest practical access are relevant when deciding how an AI tool can reach organizational context.
Try Vivendur in actionLimits of this connection
This was a campaign against customer accounts, not evidence of a Snowflake platform vulnerability. An AI memory layer does not substitute for MFA or endpoint protection.