Stale cloud trust opens customer data to supply-chain theft
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, November 10th, 2026.
Customer data was stolen after attackers used compromised credentials linked to Qubole’s AWS account to assume trusted roles in other organizations’ cloud environments. The campaign affected over a dozen organizations and ran from October 14th to October 26th. Attackers enumerated resources, collected secrets and configurations, and exfiltrated data from S3 buckets. Dormant Qubole roles that remained after the platform was no longer used widened the opening.
Cross-account roles are normal for cloud services, but they can preserve powerful access after a business relationship ends. Some exposed roles could read nearly all the data the attackers pursued, including entire storage buckets in certain cases. For leaders, vendor offboarding must include the removal of cloud identities, roles and trust policies. For defenders, find old integrations, revoke unnecessary roles, rotate every reachable secret and review cloud logs for suspicious sessions. The larger pattern is that forgotten trust can outlive the service that originally justified it. Remove obsolete third-party cloud roles and investigate every resource and secret those roles could access.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
