Santander and Ticketmaster Breach: Snowflake Denies Link

Data breaches at Ticketmaster and Santander Bank have been allegedly linked to attacks on cloud storage provider Snowflake. The hacking group ShinyHunters claimed responsibility for both breaches. They allege that the Ticketmaster breach affects 560 million users, while Santander's breach purportedly involves the data of 30 million individuals.

Snowflake has acknowledged unauthorized access to some customer accounts but denies any vulnerability within its systems. The company attributes the breaches to compromised customer credentials from unrelated cyber activities. Snowflake’s Chief Information Security Officer emphasized that the company has been investigating increased cyber threat activity targeting customer accounts since mid-April 2024.

Snowflake is used by over 9,000 customers globally, including many large companies, such as Adobe, AT&T, Capital One, Doordash, HP, Kraft Heinz, Mastercard, Okta, PepsiCo, Siemens, Western Union, Yamaha, and many more.

The Ticketmaster breach includes information such as names, email addresses, phone numbers, and partial credit card details. Meanwhile, the Santander breach includes bank account details and credit card numbers, affecting customers in Chile, Spain, and Uruguay.

In a post on a hacking forum, the ShinyHunters group posted an advert reporting they had data amounting to:

• 30 million individuals’ bank account details
• 6 million account numbers and balances
• 28 million full credit card numbers, complete with verification details and expiration dates (not including CVV)
• HR information for staff

According to a report from cybersecurity firm Hudson Rock, the hackers gained access to Ticketmaster and Santander data by exploiting credentials from a Snowflake employee. The report alleged that credentials allowed the attackers to bypass the Okta authentication service and generate session tokens to extract data from Snowflake's cloud storage systems. The report was taken down on Monday after receiving a letter from Snowflake's legal counsel.

The hackers reportedly sought to extort $20 million from Snowflake in exchange for the stolen data — a claim the company has not confirmed.

Live Nation, the parent company of Ticketmaster, confirmed the breach in a regulatory filing on May 31. While a spokesperson has confirmed that the stolen database was hosted on Snowflake, the cloud storage provider denies that it has suffered any breach.

Santander also confirmed the breach, stating that certain information relating to customers and current and former employees had been accessed. The bank assured that no transactional data or online banking credentials were compromised.

Authorities and cybersecurity firms are actively investigating the incidents, and cybersecurity company Mandiant is helping Snowflake customers affected by the breaches.