Snowflake is facing significant security challenges due to recent customer data breaches. Following Ticketmaster, LendingTree confirmed that its subsidiary, QuoteWizard, experienced data theft linked to Snowflake. Snowflake attributes these breaches to customers not using multi-factor authentication (MFA), which it does not enforce by default. The company acknowledged that a former employee's demo account, protected only by a username and password, was compromised.
Key Issues
- Customer Data Breaches: LendingTree confirmed data theft from its subsidiary, QuoteWizard, linked to Snowflake. Ticketmaster was the first to report a breach.
- Lack of MFA: Snowflake attributes the breaches to customers not using MFA, a security measure it does not enforce by default.
- Compromised Demo Account: A former Snowflake employee's demo account was compromised, highlighting a security flaw in Snowflake's model.
Snowflake's Response
- Limited Communication: Snowflake has provided minimal information, reiterating that its systems were not breached and blaming the lack of MFA.
- Notification to Customers: Snowflake has notified a limited number of customers but has not disclosed the exact number affected.
- Investigation and Assistance: Snowflake has involved Mandiant for customer outreach and investigation.
Unresolved Questions
- Scale of Impact: It remains unclear how many customers are affected.
- Detection and Response Time: Questions arise about why Snowflake did not detect the data exfiltration sooner.
- Role of Demo Account: Uncertainty surrounds the role of the compromised demo account in the breaches.
- Definition of Sensitive Data: Snowflake has not clarified what it considers "sensitive data."
Future Actions
- Potential MFA Rollout: Snowflake is considering enforcing MFA by default for its customers, especially for privileged accounts, but no timeframe has been provided.
Conclusion
Snowflake's security issues are ongoing, with multiple customer breaches linked to the lack of MFA. The company has been criticized for its limited communication and delayed response. Future plans may include enforcing MFA to enhance security.
