INCIDENT REPORT · CP-2024-005

Snowflake customer-account data theft campaign

L3 · ELEVATEDCONFIRMED

From at least April 2024, a financially motivated actor used stolen credentials to access Snowflake customer instances, steal data and extort victims. Live Nation disclosed the Ticketmaster theft in an 8-K on 31 May 2024.

Incident ID: CP-2024-005
Disclosure date: 31 MAY 2024
Detection date: 20 MAY 2024
Affected countries: United States
Plotted location: Dallas, United States (Headquarters of the largest disclosed affected organization (AT&T))
Threat classification: Level 3 — ELEVATED
Classification rationale: Campaign affecting many major organizations and hundreds of millions of records, without operational disruption.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Customer credentials stolen by infostealer malware, used against Snowflake accounts that lacked MFA and network allow lists. Snowflake, Mandiant and CrowdStrike found no breach or vulnerability in Snowflake's platform.
Sectors: Telecommunications, Retail, Technology
Critical infrastructure: No
Organizations affected: AT&T, Ticketmaster (Live Nation Entertainment), Other Snowflake customers (about 165 organizations notified)
Operational consequences: AT&T disclosed that call and text records of nearly all its cellular customers were stolen (about 109–110 million people). Live Nation reported data, mainly from Ticketmaster, offered for sale on the dark web.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by Mandiant (Google) to the financially motivated threat actor UNC5537

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Snowflake customer-account data theft campaign

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2024-005

Disclosure date

31 MAY 2024

Detection date

20 MAY 2024

Affected countries

United States

Plotted location

Dallas, United States (Headquarters of the largest disclosed affected organization (AT&T))

Threat classification

Level 3 — ELEVATED

Classification rationale

Campaign affecting many major organizations and hundreds of millions of records, without operational disruption.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Customer credentials stolen by infostealer malware, used against Snowflake accounts that lacked MFA and network allow lists. Snowflake, Mandiant and CrowdStrike found no breach or vulnerability in Snowflake's platform.

Sectors

Telecommunications, Retail, Technology

Critical infrastructure

Organizations affected

AT&T, Ticketmaster (Live Nation Entertainment), Other Snowflake customers (about 165 organizations notified)

Operational consequences

AT&T disclosed that call and text records of nearly all its cellular customers were stolen (about 109–110 million people). Live Nation reported data, mainly from Ticketmaster, offered for sale on the dark web.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by Mandiant (Google) to the financially motivated threat actor UNC5537