---
title: Forgotten Qubole Integrations Gave a Hacker Keys to Company Clouds
description: Sentra says an attacker abused dormant vendor roles to take secrets and cloud storage data from more than a dozen companies. No attribution yet.
canonical_url: https://codekeeper.co/ticker/forgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Data breaches](https://codekeeper.co/ticker/tag/data-breaches)

# Forgotten Qubole Integrations Gave a Hacker Keys to Company Clouds

Sentra says an attacker abused dormant vendor roles to take secrets and cloud storage data from more than a dozen companies. No attribution yet.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 11, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

From October 14 to October 26, 2026, an unidentified attacker used compromised IAM credentials from an AWS account tied to big-data platform Qubole to get inside more than a dozen organizations’ cloud environments. Many had quit Qubole long before but never deleted the roles that let its account in. Each request carried the right External ID, so AWS took the intruder for Qubole. Sentra, which spotted the campaign, says the attacker read about 100 passwords and keys in seven minutes from Secrets Manager, SSM Parameter Store, and Lambda settings. TruffleHog then tested stolen AWS, Entra ID, and Okta credentials, and some S3 buckets were downloaded whole. How the attacker got Qubole’s credentials hasn’t been disclosed, and Qubole hasn’t issued a statement or fix. Wiz, which disclosed the findings with Sentra and Mandiant on November 9, tells organizations that integrated with Qubole to search CloudTrail from October 1 for role assumptions by account 805246085872 from non-AWS addresses, rotate anything an affected role could read, and revoke its sessions. Unused vendor roles should go; Wiz says a source-IP condition alone would have blocked every role assumption it saw. Source: [SecurityWeek](https://www.securityweek.com/over-a-dozen-organizations-hit-in-qubole-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fforgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks France Ties Supermarket Fridge Hacks to Iran’s Revolutionary Guard Nov 10, 2026](https://codekeeper.co/ticker/france-ties-supermarket-fridge-hacks-to-irans-revolutionary-guard)

[Cyberattacks Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug Nov 10, 2026](https://codekeeper.co/ticker/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug)

[Cyberattacks Jailbroken DeepSeek Agent Ran a Telecom Hack Mostly Unsupervised Nov 10, 2026](https://codekeeper.co/ticker/jailbroken-deepseek-agent-ran-a-telecom-hack-mostly-unsupervised)

[Cyberattacks Sega Customer Emails Exposed in Third-Party Vendor Breach Nov 10, 2026](https://codekeeper.co/ticker/sega-customer-emails-exposed-in-third-party-vendor-breach)