Security AlertHigh
Qubole AWS customer accounts were breached, Wiz says
Nov 9, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
An attacker used Qubole AWS credentials to access multiple customer accounts between October 14 and 26. Wiz says the attacker stole secrets and data from AWS services.
Key points
- Qubole is a data lake platform owned by Idera.
- Wiz says CloudTrail logs should be checked from October 1 onward.
- The attacker copied data from S3 and searched Secrets Manager and SSM Parameter Store.
Why it matters
If your business connected Qubole to AWS, you may need to review logs for unauthorised access. Stolen secrets can lead to follow-on compromise of cloud tools, customer data, and internal systems.
Who’s affected: AWS accounts connected to Qubole
What to do
- Check CloudTrail logs from October 1 onward.
- Review AssumeRole requests from Qubole’s AWS account.
- Inspect Secrets Manager, SSM Parameter Store, Lambda, and S3 activity.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.