One stolen Qubole key let an attacker walk into more than a dozen companies' clouds

Supply chain attack on Qubole customers

Sentra traced a supply chain attack in under 24 hours: a stolen Qubole credential opened roles at over a dozen organizations that still trusted the dormant big-data vendor. The attacker read roughly 100 secrets in seven minutes, made zero writes, and pulled data from a rented OVH server and Mullvad VPN. Because every Qubole role carried a valid ExternalId, the access looked legitimate in AWS logs — only behavior gave it away.