What happened?
In late May 2024, Live Nation confirmed that criminal actors had obtained data from its Ticketmaster unit — soon quantified at roughly 560 million customers — after attackers used infostealer-derived credentials to log directly into the company’s Snowflake tenant. No exploit, no zero-day, no malware at the victim: reused working credentials and no MFA. By May 30, when this post publishes, the breach had been listed on the ShinyHunters dark-web market and the “Snowflake intrusion wave” had become the month’s defining lesson in identity discipline.
Quick Answer: Ticketmaster’s ~560M-record exposure came from attackers (UNC5537) logging into its Snowflake account with stolen infostealer credentials — no MFA in place, no Snowflake platform breach — part of a credential-driven campaign hitting 165+ organizations that peaked through June 2024.
The mechanics were relentlessly ordinary. An employee or contractor’s credentials, siphoned months earlier by an infostealer infection somewhere entirely else, remained valid against a Snowflake tenant that lacked MFA. Attackers authenticated, queried, and exported — then pivoted to extortion, listing datasets on criminal marketplaces when victims declined to pay. Snowflake’s own thread through the saga was defensive: its threat-intelligence partners (Mandiant, later Google Cloud) documented that every confirmed victim shared the same two conditions: stolen credentials, no MFA, and either a demo account or unused legacy tenant still alive with live data inside.
The “no Snowflake breach” argument, and why it half-worked
Snowflake stated, accurately, that its platform was not breached — attackers used legitimate customer credentials against customer tenants. Technically bulletproof; commercially uncomfortable. The industry conversation split along the expected line: platform vendors emphasized customer-side identity failures, while practitioners pointed out that a data platform holding hundreds of millions of records, accessible by password alone from any IP, is a loaded gun regardless of whose finger is on the trigger. The episode forced Snowflake toward mandatory MFA — announced in waves through 2024 — and forced customers to confront the difference between “our vendor is secure” and “our use of the vendor is secure.”
| Date | Event |
|---|---|
| 2024-04 (earlier) | Campaign begins quietly; UNC5537 accumulates infostealer logs mapping Snowflake tenants |
| 2024-05-28/29 | ShinyHunters lists Ticketmaster dataset (~1.3TB claimed) for sale; Snowflake customer-warning reports surface |
| 2024-05-30 | Live Nation SEC filing confirms breach; this post publishes amid first-wave disclosures |
| 2024-06 | Campaign peaks: Santander, Advance Auto Parts, LendingTree and others disclosed; Mandiant attributes to UNC5537 |
| 2024-06-19→ | Snowflake customer report + Mandiant advisory detail TTPs; leak market “Snow:Bay” appears |
Why infostealer economics made this inevitable
Infostealers industrialized credential collection: millions of infected endpoints vacuum browser-stored passwords, session cookies, and cloud-CLI configuration into logs sold in bulk. Analysts had warned for two years that the bulk matching of those logs against SaaS consoles was a time bomb. Snowflake connectivity — by design ubiquitous and scriptable — meant one reused password bridged a $20 criminal commodity into Fortune-500 data lakes. The campaign did not invent technique; it industrialized arithmetic.
- MFA everywhere, phish-resistant where possible: every human and service identity touching the data platform — no “read-only analyst” exemptions.
- Kill demo and legacy tenants: the campaign repeatedly entered through forgotten trial/demo accounts stocked with production Mirrors of data.
- Network and key policy: allow-list egress for cloud identity, enforce key rotation, and block storage of long-lived credentials in BI tools and notebooks.
- Hunt infostealer exposure: subscribe to leak-feed services; treat any credential appearing in a stealer log as burned the day the log is indexed.
FAQ
How many companies were actually hit?
Public reporting through June converged on 165+ victim organizations, with a few dozen disclosed publicly and far more confirmed privately to Mandiant and Snowflake. The full count may never be crisp because extortion economics discourage victims from naming themselves — the leak-market listings became the de facto census.
What data did the Ticketmaster set contain?
Reported contents included names, addresses, emails, phone numbers, order history, and partial payment data (last four digits, expiry) — a rich identity-verification corpus that makes the set useful for phishing and SIM-swap targeting long after the sale headlines fade. Roughly 560 million individuals were covered in the claimed dataset.
Did Snowflake require MFA after this?
Yes — through 2024 Snowflake rolled out mandatory MFA/TOTP for its platform, alongside network-policy defaults and hardened client-credential handling. Vendors across the data-platform market followed within months, making “password-only access to a data lake” a compliance anomaly rather than a common misconfiguration.
The Shared-Incident Blame Model
SRE culture has a blameless-postmortem ethic for internal incidents; the Snowflake wave stress-tested it across company boundaries. Customers blamed the vendor’s defaults; the vendor published a customer-facing security guide implying customer negligence; insurers began drafting subrogation language. What survived the shouting was a useful doctrine: shared-infrastructure incidents require pre-agreed responsibility matrices — who enforces MFA, who monitors authentication anomalies, who decommissions demo tenants — written before the breach, not negotiated during it.
Role-based accesses bastion-adjacent controls
One engineering postscript that got less attention than the extortion drama: the campaign exposed how rarely Snowflake tenants enforced network policies and key-pair auth before 2024. Post-incident, the platform’s own guidance — allow-listed egress, key-pair or OAuth flows for service accounts, row-access policies — moved from “recommended” to table stakes, and auditors started asking for tenant configuration exports as evidence. The wave’s technical legacy is that data-warehouse identity architecture finally got the review web applications got a decade earlier.
A modest proposal that emerged
The strangest durable outcome was a market one: breached-but-unpaid datasets pooled into a dedicated leak marketplace (dubbed “Snow:Bay” by researchers), letting multiple criminal buyers resell access tiers. Defenders took note because leak-market persistence changes notification math — data does not “leave” once; it circulates with a price curve. Long-tail monitoring of criminal markets thus graduated from threat-intel luxury to breach-response line item.
