Wiz said an attacker used compromised credentials from an AWS account associated with Qubole, a data processing platform, between October 14 and 26, 2026. The attacker took on roles that customers had set up to trust Qubole's account, then listed resources, gathered secrets and downloaded S3 data. Sentra spotted the activity and told Wiz, which worked with Mandiant. BleepingComputer reported that tens of companies were affected.
Wiz does not say how the credentials were compromised or what the attacker will do with the data. On November 11, Wiz noted that Risky Business reported an actor calling itself "n0n" had claimed the intrusion. Wiz found no ties to other public campaigns.
Such a role trusts a whole vendor account. The only gate is an External ID, which Wiz says appears in plain text in CloudTrail logs. Many victims had no Qubole traffic, yet their unused roles still accepted the requests. A vendor role is a standing credential and needs the same review as any other. Ask which vendors hold roles in your accounts, which are unused, and whether each is limited to the vendor's network. Wiz said a source-IP limit alone would have blocked every request it saw. Also turn on S3 data event logs, or you cannot see which objects were read.