On April 19, 2024, AT&T learned about its breach from the burglar's claim. Its securities filing puts it in one flat sentence: the company "learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs." Sit with that. A company whose entire business is knowing who called whom did not find this out from an alert, or a dashboard, or a log review. The news arrived as a claim from outside.
The claim was accurate. Between April 14 and April 25, intruders entered a workspace AT&T kept on the cloud data platform Snowflake and took files of call and text records for nearly all of its wireless customers - roughly 110 million people were eventually notified - covering roughly May 1 to October 31, 2022, plus one day, January 2, 2023. AT&T was one of more than 165 organizations the same campaign reached that spring. When Connor Riley Moucka, a 26-year-old from Kitchener, Ontario, pleaded guilty in a Seattle federal court this August, the Justice Department counted the results as billions of sensitive customer records and extortion payments in the millions.
The discovery came from outside
Mandiant, the incident response firm that worked the campaign with Snowflake, found no evidence of any breach of Snowflake's own environment. Every incident it handled traced back to customer credentials stolen by infostealer malware from machines outside Snowflake's control, replayed against accounts that had no second factor, no network allow list, and passwords that in many cases "had not been rotated for as long as four years." MFA was optional at the platform level; Snowflake did not require it, and in the aftermath said it was "developing a plan" to change that. The company's own house was not tidy either - it admitted a threat actor obtained a former employee's credentials and used them on demo accounts protected by nothing more than a username and password.
But the detail I keep returning to is not how they got in. It is how the victims found out. In every case that became public, the news arrived from outside. LendingTree, whose QuoteWizard subsidiary was hit, put it in a sentence: "we were notified by them that our subsidiary, QuoteWizard, may have had data impacted by this incident." Notified by Snowflake - which had been notified by Mandiant, which had been notified by threat intelligence: records that turned out to have originated inside a victim's Snowflake instance. Mandiant's own account of the campaign begins with that outside-in moment, in April 2024. On May 22, having identified a broader campaign, it called Snowflake, and the two of them began notifying roughly 165 potentially exposed organizations, one awkward phone call at a time.
And when the victims did look inward, they could only see so far. A week after its write-up, Mandiant published a hunting guide for compromised Snowflake instances and noted, in passing, the quietly damning number: the default retention policies on the relevant account views enable hunting across the past one year. Set that against the credentials side of the same campaign - passwords unchanged for as long as four years - and you get the sentence this article exists for. The platform's memory was younger than its passwords. An intruder who first tested your account in 2022 would be standing in history you no longer kept.
The cheapest control I own
The lock on my own ledger is ordinary. I run a leaderboard where site owners bid real money for rank, which makes me a very small payments company, and I have zero exotic security tools. What I do have is rows. Every event Stripe sends us gets its event ID written to an events table before a single thing happens on the back of it; when Stripe redelivers the same event - and payment processors redeliver constantly - the insert comes back empty and the handler refuses to do the work twice. Every review verdict on every submitted site is a row too: decision, category, reasons, a confidence number, a timestamp. Nobody reads these rows on a good day. They are the whole answer on a bad one.
Because the bad day arrives as questions, and the questions are always the same five: who got in, through which door, when, what did they touch, and is it still happening. Answer from memory and you are guessing in front of your customers. Answer from a record and you are reporting. The gap between those two postures is not a budget line - a log row costs fractions of a cent. The Snowflake victims were not short of money; among them were banks, ticketing giants and the phone company I started this story with. What that spring exposed is that a record you did not keep cannot answer for you: the news arrived from outside, the default hunting window ran one year deep, and the passwords ran four.
Moucka pleaded guilty, and the argument the industry has had since his campaign is mostly about MFA, which is fair as far as it goes - a lock beats no lock. The quieter lesson is the one I would put on a small site's wall. Your prevention will fail someday, on a day you will not know was the day, and the only thing standing between that day and a shrug is the record you started back when nothing was wrong.
Bid your way to the top spot at bidspotlight.com - the record starts the moment you do.