Sentra and Wiz trace AWS data theft to customer roles that trusted Qubole
Sentra co-founder Ron Reiter traced stolen files to Qubole-trusted customer roles. Wiz says an attacker used those roles across customer AWS accounts from October 14th to 26th, 2026, and that most assumed roles were not otherwise in use.
By RuntimeWire Staff · Published
Primary source: Hacker News
Why it matters
Vendor integrations leave standing AWS trust after contracts end, so one stolen vendor credential can become valid access into many customer accounts at once. The Qubole case gives security teams a concrete hunt: find external roles, check whether the vendor still uses them, pin them to known networks, and delete the ones nobody owns.
Ron Reiter (@ronreiter) had a clean story to tell on November 9th, and an uncomfortable one for anyone who has ever connected a vendor to AWS and moved on. Reiter, Sentra's co-founder and CTO, wrote up how an attacker holding credentials tied to Qubole, a big-data platform, used roles that customers had once created for Qubole to enter their AWS environments and pull data.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.