Snowflake customer tenant extortion campaign (UNC5537)
Starting in April 2024, UNC5537 logged into about 165 Snowflake customer accounts with credentials stolen by infostealer malware, some as far back as 2020, then stole data and extorted the victims. Snowflake first warned of identity-based attacks on customer accounts on May 31, 2024, and Mandiant's June 10 report found no breach of Snowflake's own platform: the affected accounts lacked MFA, had not rotated credentials, and had no network allow lists.
- Victim
- Multiple: about 165 Snowflake customers
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Apr 2024
- First disclosed
- May 31, 2024
- Actor
- UNC5537 (Financially motivated)
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The platform was not hacked; single-factor logins were. Enforced MFA, credential rotation and network policies on data platform accounts would have stopped every login in the campaign.
Regulatory and legal outcome
Connor Moucka pleaded guilty in US federal court on August 6, 2026; see the teardown for case details.
Go deeper on SWI
- Teardown: The 2024 Snowflake customer breaches: stolen credentials meet missing MFA
- Technique: Infostealer credential harvesting
- Technique: Credential stuffing
- SWI coverage: snowflake hacker connor moucka pleads guilty
Sources
- UNC5537 targets Snowflake customer instances for data theft and extortion, Google Cloud (Mandiant), Jun 10, 2024
- Detecting and preventing unauthorized user access, Snowflake, May 31, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
- Advance Auto Parts job applicant data stolen from its Snowflake account 2024 · Stolen credentials
- Ticketmaster customer data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Snowflake customer tenant extortion campaign (UNC5537). Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-snowflake-customer-tenant-campaign/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.