Advance Auto Parts job applicant data stolen from its Snowflake account

Advance Auto Parts found unauthorized activity in a third-party cloud database on May 23, 2024, and a criminal offered its data for sale on June 4. The company later confirmed the data came from its Snowflake environment and notified 2,316,591 people in July 2024 that names, Social Security numbers, driver's license numbers and dates of birth from job application records may have been taken.

Victim

Advance Auto Parts

Industry

Retail and e-commerce

Country

United States

Intrusion began

Apr 14, 2024

First disclosed

Jun 14, 2024

Actor

Financially motivated

Initial access

Stolen credentials

Identity control that failed

Authentication

MFA

Not enforced on the abused account

Abused identity

Human account

Records affected

2.3 million (Individuals (current and former job applicants and employees), per the company's filing with the Maine attorney general.)

Disclosed cost

$3 million (Expected expense of about $3 million for the quarter ending July 13, 2024, per the June 2024 8-K (costs largely within its cyber insurance retention).)