Attacker abuses Qubole platform AWS account credentials to assume customers' trusted roles and steal secrets and S3 data

SecurityWeek reported on November 10 that researchers found the attacker used leaked IAM credentials for a Qubole-associated AWS account to steal data from over a dozen organizations. Citing Sentra, the report said the attacks came from a rented OVH server and Mullvad VPN, none of the observed activity originated from Qubole's network, and the abused Qubole roles had remained in place long after some companies stopped using Qubole.

“Any organization that has connected Qubole to AWS, even one that no longer uses it, should check its CloudTrail logs from October 1 onward.”

Osaka City said in its Nov 13 final report that an external mail-delivery service used by its administrative online system was accessed without authorization, confirming 1,078,713 user email addresses leaked, covering addresses that received system emails between Jul 1 and Oct 31, 2026 .