Snowflake says it wasn't to blame for Ticketmaster breach — and its security pals agree

A zoomed-in picture of a computer screen displaying a login window with a password typed in
(Image credit: Future)

Snowflake has claimed it isn't to blame for the major data breach that hit Ticketmaster, despite the company blaming it for security weaknesses.

Earlier this week, the ticket sales and distribution company reported a data breach in which sensitive information on more than 500 million users were allegedly stolen. 

Filing a data breach form with the SEC, Ticketmaster said that it “identified unauthorized activity within a third-party cloud database environment containing company data" - which an unnamed spokesperson later said related to Snowflake.

No evidence

Now, that company is denying these claims, and has brought two cybersecurity companies to back them up. 

In a forum thread posted on June 2, Snowflake representatives said an preliminary investigation, conducted by both CrowdStrike and Mandiant, suggested this was a credential stuffing attack, and not a system vulnerability being exploited:

“Our key preliminary findings identified to date:

we have not identified evidence suggesting this activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform;

we have not identified evidence suggesting this activity was caused by compromised credentials of current or former Snowflake personnel;

this appears to be a targeted campaign directed at users with single-factor authentication;

as part of this campaign, threat actors have leveraged credentials previously purchased or obtained through infostealing malware,” the announcement reads.

However, the researchers did find that one of the compromised accounts belonged to a former Snowflake employee. This was a demo account, and as such, did not contain sensitive data, or was able to grant access to such data. 

“Demo accounts are not connected to Snowflake’s production or corporate systems,” the announcement concluded. “The access was possible because the demo account was not behind Okta or Multi-Factor Authentication (MFA), unlike Snowflake’s corporate and production systems.”

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.