Vendor incident, severity critical

Qubole's AWS access abused to breach customer AWS accounts and steal secrets and data

Published November 9, 2026

Wiz reported that an attacker broke into AWS accounts of multiple Qubole customers between October 14 and October 26 and stole stored secrets and data. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker obtained those credentials has not been disclosed.

What's affected

• quboleevery version

Exposure window: 14 Oct 2026 00:00 to 26 Oct 2026 00:00 UTC.

What to do

1. Check whether your AWS accounts are connected to Qubole and review the access granted to it.
2. Review AWS activity logs for unexpected access between October 14 and October 26.
3. Rotate secrets and credentials stored in AWS accounts that Qubole could reach.

Secrets to rotate if you were affected

Cloud credentials.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident qubole-aws-customer-breach-2026-11

References

• https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html

Notice qubole-aws-customer-breach-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.