Public Integration Without Authentication Exposes Critical Control Failure

ShinyHunters claimed a breach of Rockstar Games’ environment through a Snowflake integration. The vector was not a compromise of game infrastructure. It was exploitation of a third-party cloud data platform via misconfigured access controls.

The Snowflake campaign - attributed to UNC5537 - followed a consistent pattern across multiple victims: credentials harvested by infostealer malware were used to authenticate directly to Snowflake customer tenants. The control gap was not in Snowflake’s platform architecture. It was in customer-side identity enforcement - specifically, the absence of mandatory MFA on service accounts and integration credentials used to access Snowflake environments.

Not confirmed: the specific credential source for the Rockstar Games claim. Not confirmed: whether the compromised integration used a service account, API key, or user-bound credential. Not confirmed: the nature, scope, or volume of accessed data.

The structural failure is in trust delegation. When an organization integrates with a third-party data platform, authentication to that platform becomes part of the organization’s identity boundary - not the provider’s. Snowflake offered MFA. The customer either did not enforce it or excluded integration accounts from the policy. That exclusion is the attack surface.

This is the pattern that repeats across cloud integration breaches: credentials with direct data access, no MFA enforcement, no session anomaly detection, no IP restriction on API access. Each missing control widens the blast radius. Infostealers provide the initial credential. The absence of layered identity controls provides everything else.

Not confirmed: exposure duration. Not confirmed: whether detection occurred through internal monitoring or external notification.

What must change: every credential with access to a cloud data platform must enforce MFA - no exceptions for service accounts or integration pipelines. IP allowlisting on Snowflake network policies must be mandatory, not optional. Session behavior monitoring must flag credential use from novel infrastructure. The integration account is not a lesser identity. It is a direct path to production data, and it must be governed as one.