Stolen Qubole-linked AWS credentials were used to enter customer accounts
Wiz and Sentra traced an attacker using IAM credentials from an AWS account associated with Qubole to assume integration roles. The actor stole S3 data and accessed secrets that could reach AWS, Entra ID and Okta. Dormant trust policies still granted access.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- AWS accounts with IAM roles trusting the Qubole-linked account, including unused integrations.
- AWS · IAM · supply chain
- In the wild
- Yes
- Wiz and Sentra observed unauthorized role assumption and access to customer AWS resources.
What happened
The attacker presented the expected External ID to obtain temporary credentials for roles that still trusted the Qubole-linked account. The role policies determined what was reachable. Management events can show role assumptions and bucket enumeration. S3 object reads require data events or server access logs. The research does not explain how the vendor credentials were acquired. Wiz noted a third-party report of a claim of responsibility on November 11 and has not established attribution.
Crime-scene timeline
Oct 8–11, 2026
Wiz observes separate customer-key activity
An actor used customer-owned keys believed to have been created for Qubole. Wiz has not linked this activity to the later role assumptions.
Oct 14–26, 2026
Attacker assumes customer integration roles
Wiz observes secret harvesting, checks of stolen credentials and S3 exfiltration.
Nov 9, 2026
Wiz and Sentra disclose their findings
They publish role-assumption and data-access hunting guidance.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Wiz incident-response researchPrimaryDocuments successful role assumption, secret validation, S3 exfiltration, detection and the November 11 unverified claim of responsibility.
- Sentra incident-response researchPrimaryExplains detection and the scope observed in Sentra customer environments.