Snowflake Aftermath: Pure Storage Notifies of Data Breach

Pure Storage has confirmed a data breach involving unauthorized access to a Snowflake data analytics workspace, as reported on its official support page. This breach exposed telemetry information including company names and email addresses, LDAP usernames, and Purity software release version numbers used to provide Pure Storage customer support.

The breach has raised concerns among the more than 11,000 customers using Pure Storage's platform, which includes high-profile organizations like Meta, Ford, and JP Morgan. However, Pure Storage assured users that critical information such as passwords was not compromised. "The workspace did not include compromising information such as passwords for array access, or any of the data that is stored on the customer systems," the company stated.

Pure also claims it acted immediately to prevent further unauthorized access, adding that "no evidence of unusual activity on other elements of the Pure infrastructure" has been found. The statement concluded by saying that this conclusion has been backed up by “preliminary findings from a leading cybersecurity firm.”

The Register highlighted a Mandiant report that claims the breach was most likely linked to a lack of multi-factor authentication on customer accounts — an issue common to other Snowflake-related attacks. Pure Storage has neither confirmed nor denied this claim.

As we reported recently, this incident is part of a larger pattern of breaches involving Snowflake, including high-profile attacks on Ticketmaster and Santander Bank. The hacking group ShinyHunters, which claimed responsibility for the Ticketmaster and Santander breaches, asserted that these incidents affected hundreds of millions of users, revealing names, email addresses, phone numbers, and partial credit card details.

The broader implications of the Pure Storage breach are significant, given that the threat actor UNC5537, linked to this and other Snowflake breaches, has been active since May 2024. According to Mandiant, this group has exploited stolen customer credentials to target multiple accounts without multi-factor authentication.