# Qubole Attack Exposes Cloud Credentials

A Qubole-related supply-chain attack ran from October 14 to October 26, 2026. Using Qubole AWS credentials, the attackers assumed customer roles, accessed cloud data, and harvested AWS, Entra ID, and Okta credentials; Sentra reported that dozens of customers were affected. No government contract or procurement opportunity was identified, but the incident is relevant to contractors that rely on third-party cloud integrations and manage sensitive government or customer data.

- Contractors should review AWS CloudTrail activity for the attack period and assess whether third-party integrations had cross-account access to their environments.
- Organizations should revoke unused permissions, rotate potentially exposed credentials, and tighten cross-account trust policies, as recommended in the signal.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 10, 2026

### Vendors
- Qubole ()

### Sources
- [Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials | CSO Online](https://www.csoonline.com/article/4246780/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials.html) - CSO Online