Cloud Misconfiguration Lets Attackers Steal Customer Data from Qubole

A cloud‑security firm reported that an attacker accessed Amazon Web Services (AWS) accounts belonging to several Qubole customers between October 14 and October 26, 2026, using credentials for a single, highly privileged AWS account that Qubole’s platform uses to reach those customers. The breach resulted in the theft of stored secrets and other data; Qubole, which is owned by Idera, has yet to disclose how the attacker obtained the credentials. The incident was detected after nearly two weeks when Wiz logged the activity on its monitoring system.¹

The attacker likely leveraged a compromised IAM role with overly permissive policies, allowing them access beyond the intended scope. Similar incidents have been observed before—most notably in 2018 when misconfigured S3 buckets exposed sensitive data due to broad permissions—and underscore ongoing challenges around least privilege principles within shared‑responsibility cloud environments where providers and customers can create such vulnerabilities if not carefully managed as systems evolve organically without constant review cycles for security