How the 2024 Snowflake breaches happened: old stolen passwords and no second lock

Some of the passwords used in the 2024 Snowflake data thefts had been stolen more than 3 years earlier, and nobody had changed them.^[1] This case file covers how a group logged into about 165 companies' accounts on a cloud data platform that was never itself broken into, what it cost, and the one control that would have stopped it.

What happened

How they got in

No hacking of Snowflake's own systems was needed. Mandiant found no evidence that the attackers got in through a breach of Snowflake's corporate environment. Every incident it traced came back to a customer's own username and password.^[1]

Those passwords had been collected by infostealer malware, a kind of malicious software that quietly copies saved logins from an infected computer and sends them to criminals, who resell them. Mandiant said at least 79.7% of the accounts used in the campaign had credentials that were exposed before, some as far back as November 2020.^[1] Several of the infections were on computers belonging to contractors, machines that were also used for personal activities such as gaming and downloading pirated software, and that were used to reach more than one client's systems.^[1]

Three things lined up in the accounts that were raided. They did not require multi-factor authentication, the second check such as an app prompt or code that a stolen password alone cannot pass. The passwords had not been changed, in some cases for years. And there was no network allow list, a setting that only accepts logins from approved locations.^[1] With all three missing, a password bought from a criminal market was enough.

How it was caught and what it cost

A Canadian man, Connor Riley Moucka of Kitchener, Ontario, was arrested in Canada on October 30, 2024 on a U.S. warrant.^[3] In August 2026 he pleaded guilty in federal court in Washington state to computer fraud, wire fraud, aggravated identity theft and conspiracy. His sentencing is set for October 27, 2026, and he faces up to 32 years.^[3][4]

According to the case record reported at his plea, the scheme collected about $2.5 million in extortion payments, he made at least $495,000 more selling stolen data, and victim companies documented about $9.5 million in losses.^[4] A U.S. Army soldier, Cameron Wagenius, separately pleaded guilty in July 2025 to extorting AT&T and Verizon with stolen call records. A third man, charged as a co-conspirator, was held in Turkey, which prosecutors cannot easily reach.^[3]

AT&T did not confirm a payment, but published reports, based on the hacker's own account and a blockchain analysis firm's check of the transfer, said about $370,000 in bitcoin was paid in May 2024 to have its records deleted.^[5]

On July 10, 2024, Snowflake gave account administrators a way to require multi-factor authentication for all their users, and began prompting users without it to turn it on.^[6]

The missing control

The missing control: enforced multi-factor authentication, backed by regular rotation of old passwords.

Either half would likely have broken this. A second login factor means a password copied off an infected contractor laptop is not enough on its own. Changing passwords when staff and contractors change, or on a schedule, would have made credentials stolen in 2020 useless by 2024. An allow list limiting logins to the company's own network would have added a third wall.^[1] None of these depended on the cloud provider. They were settings each customer could have turned on.

What to do in your business

• Turn on MFA everywhere data lives. List your cloud accounts: email, file storage, accounting, payroll, customer databases. Require a second factor for every human login, and check that it is enforced, not just offered.
• Retire old passwords. Change passwords that have not been changed in a year, and close accounts for anyone who has left, including contractors and former vendors.
• Treat contractor computers as your risk. Ask contractors who log into your systems to use a device kept for work, with up-to-date security software, and give them their own accounts rather than shared ones.
• Limit where logins can come from. If your tools support it, restrict admin and data access to your office network or a company VPN.
• Watch for bulk downloads. Turn on alerts for unusual logins and large data exports, and have someone look at them each week.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.