Qubole AWS trust policy breach exposes customer data

On November 9, 2026, The Hacker News reported that an attacker had broken into AWS accounts belonging to multiple Qubole customers between October 14 and October 26. The attacker used credentials for an AWS account that Qubole's platform uses to reach customers, exploiting a trust policy that allowed the role to be assumed. Wiz researchers said the attacker read environment variables, pulled secrets from Secrets Manager, and copied data out of S3.

On November 10, 2026, BleepingComputer, CSO Online and SecurityWeek reported that the attacker used compromised IAM credentials for Qubole's AWS account to assume cross-account roles in customer environments between October 14 and 26. The campaign affected at least a dozen organizations, with counts ranging from tens to dozens, and exposed AWS, Microsoft Entra ID and Okta credentials. The intruder enumerated cloud resources, harvested secrets and downloaded data from S3 buckets.