Connect with us

Technology

What Snowflake isn’t saying about its customers’ data breaches

Published

on

an illustrated laptop on a red darkened background, with blue flakes of data spilling out of the laptop

Snowflake’s security problems are, for lack of a greater word, growing after a recent wave of customer data theft.

After Ticketmaster became the primary company to link its recent data breach to cloud computing company Snowflake, loan comparison site LendingTree confirmed that its QuoteWizard subsidiary had data stolen from Snowflake.

“We can confirm that we use Snowflake for our business operations and have been notified by Snowflake that this incident may have impacted data from our QuoteWizard subsidiary,” Megan Greuling, a spokeswoman for LendingTree, told TechCrunch.

Advertisement

“We take these matters seriously and initiated an internal investigation immediately after receiving information from (Snowflake),” the spokesman said. “At this time, there does not appear to be an impact on consumer financial account information or LendingTree’s parent information,” the spokesperson added, declining to comment further, citing the continuing investigation.

As increasingly affected customers come forward, Snowflake has said little other than a brief statement on its website reiterating that there was no data breach on its own systems, but somewhat that customers weren’t using multi-factor authentication, or MFA, a security measure that Snowflake doesn’t implement or require its customers to enable by default. Snowflake itself caught wind of the incident, claiming that a former worker’s “demo” account was compromised since it was only protected by a username and password.

In an announcement Friday, Snowflake firmly stood by its response thus far, saying its position “remains unchanged.” Referring to his earlier statement on Sunday, Snowflake’s chief information security officer, Brad Jones, said it was a “targeted campaign targeting users using single-factor authentication” and using credentials stolen from information-stealing malware or obtained through previous data breaches.

The lack of MFA appears to be causing cybercriminals to download massive amounts of data from Snowflake customer environments that weren’t protected by an extra layer of security.

Advertisement

Earlier this week, TechCrunch found lots of of Snowflake customer credentials stolen online by password-stealing malware that was infecting the computers of employees who had access to their employer’s Snowflake environment. The credential count suggests there’s a risk for Snowflake customers who haven’t yet modified their passwords or enabled MFA.

Over the course of the week, TechCrunch sent Snowflake greater than a dozen questions about the continuing incident affecting its customers as we proceed to report on this story. Snowflake refused to reply our questions a minimum of six times.

These are among the questions we ask ourselves and why.

It shouldn’t be yet known what number of Snowflake customers are affected or whether Snowflake already knows about it.

Snowflake said it has thus far notified “a limited number of Snowflake customers” that the corporate believes could have been affected. On its website, Snowflake says it has greater than 9,800 customers, including technology corporations, telecommunications corporations and health care providers.

Advertisement

Snowflake spokeswoman Danica Stańczak declined to say whether the variety of affected customers was within the tens, tens, lots of or more.

It’s likely that despite several customer breaches reported this week, we’re only just starting to know the dimensions of this incident.

Even for Snowflake, it might not be clear how many shoppers are affected, as the corporate will either should depend on its own data, equivalent to logs, or discover directly from the affected customer.

It is unclear how quickly Snowflake could have learned about the hacking of its customers’ accounts. In an announcement, Snowflake said it became aware of “threat activity” on May 23 – accessing customer accounts and downloading their content – but later found evidence of intrusions dating back to around mid-April, suggesting the corporate had some data on whom he can rely.

Advertisement

But that also leaves open the query of why Snowflake didn’t detect the exfiltration of huge amounts of customer data from its servers until much later in May, and if that’s the case, why Snowflake didn’t publicly notify its customers earlier.

Mandiant, an incident response company that Snowflake called to assist reach customers he told Bleeping Computer in late May that the corporate has been helping affected organizations for “several weeks.”

We still do not know what was in the previous Snowflake worker’s demo account and whether it’s related to customer data breaches.

A key line from Snowflake’s statement reads: “We found evidence that the threat actor obtained personal credentials and accessed demo accounts belonging to a former Snowflake employee. It did not contain sensitive data.”

An evaluation by TechCrunch shows that among the stolen customer credentials related to the information-stealing malware include data belonging to a then-Snowflake worker.

Advertisement

As we have previously noted, TechCrunch shouldn’t be naming the worker since it’s unclear whether he did anything improper. The indisputable fact that Snowflake was caught failing to implement MFA, allowing cybercriminals to download data from a then-employee’s “demo” account using only their username and password, highlights a fundamental problem in Snowflake’s security model.

However, it’s unclear what role, if any, this demo account plays within the theft of customer data, because it shouldn’t be yet known what data was stored on it or whether it contained data from other Snowflake customers.

Snowflake wouldn’t say what role, if any, the then-Snowflake worker’s demo account played within the recent customer security breaches. Snowflake reiterated that the demo account “did not contain sensitive data,” but repeatedly declined to say how the corporate defines what it considers “sensitive data.”

We asked whether Snowflake considers individuals’ personal information to be sensitive data. Snowflake declined to comment.

Advertisement

It is unclear why Snowflake didn’t proactively reset passwords or require and implement the usage of MFA on its customer accounts.

It’s commonplace for corporations to force password resets on their customers after a data breach. But if you happen to ask Snowflake, there isn’t a violation. And while this will be true within the sense that there was no apparent breach of central infrastructure, Snowflake customers are fairly often exposed to security breaches.

Snowflake advises his clients involves resetting and rotating Snowflake credentials and forcing MFA on all accounts. Snowflake previously told TechCrunch that its customers care about their very own security: “In Snowflake’s shared responsibility model, customers are responsible for enforcing MFA against their users.”

However, since Snowflake’s customer data thefts involve the usage of stolen usernames and passwords for accounts that will not be protected by MFA, it’s remarkable that Snowflake didn’t intervene on behalf of its customers to guard their accounts with a reset passwords or forced MFA.

This shouldn’t be unheard of. Last 12 months, cybercriminals deleted 6.9 million user records and genetic data from 23andMe accounts that weren’t protected with MFA. 23andMe fastidiously reset user passwords to forestall further scraping attacks after which required MFA for all of its user accounts.

Advertisement

We asked Snowflake if the corporate plans to reset passwords for its customer accounts to forestall possible further breaches. Snowflake declined to comment.

According to them, Snowflake appears to be moving towards implementing MFA by default Runtime technical news site, quoting Snowflake CEO Sridhar Ramaswamy in an interview this week. This was later confirmed by Snowflake’s CISO Jones in a Friday update.

“We are also developing a plan to require our customers to implement advanced security controls such as multi-factor authentication (MFA) or network policies, especially for privileged Snowflake customer accounts,” Jones said.

No timetable for the implementation of the plan was provided.

Advertisement

This article was originally published on : techcrunch.com

Technology

Redpoint collects USD 650 million 3 years after the last large fund at an early stage

Published

on

By

Redpoint Ventures, an organization based in San Francisco, which is a few quarter of a century, collected $ 650 million at an early stage, in keeping with A regulatory notification.

The latest RedPoint fund corresponds to the size of its previous fund, which was collected barely lower than three years ago. On the market where many enterprises reduce their capital allegations, this cohesion may indicate that limited partners are relatively satisfied with its results.

The company’s early stage strategy is managed by 4 managing partners: Alex Bard (pictured above), Satish Dharmraraj, Annie Kadavy and Eric Brescia, who joined the company in 2021 after he served as the operational director of Githuba for nearly three years.

Advertisement

The last outstanding investments of the RedPoint team at an early stage include AI Coding Pool Pool, which was founded by the former partner Redpoint and CTO GitHub Jason Warner, distributed laboratories of SQL database programmers and Platform Management Platform Platform Levelpath.

A multi -stage company also conducts a development strategy led by Logan Barlett, Jacob Effron, Elliot Geidt and Scott Raney partners. Last 12 months, Redpoint raised its fifth growth fund at USD 740 million, which is a small increase in the USD 725 million fund closed three years earlier.

The recent RedPoint outputs include the next insurance, which was sold for $ 2.6 billion in March, Tastemada Startup Media Travel -utar -Media was enriched by Wonder for $ 90 million, and the takeover of Hashicorp $ 6.4 billion by IBM.

Redpoint didn’t answer the request for comment.

Advertisement

(Tagstranslate) Early Stage Venture Capital (T) Basenside (T) Redpoint Venture Partners

This article was originally published on : techcrunch.com
Continue Reading

Technology

Tensor9 helps suppliers implement software in any environment using digital twins

Published

on

By

Enterprises must access latest software and artificial intelligence tools, but they’ll not risk sending their sensitive data to external software suppliers as a service (SAAS). Tensor9 He tries to help software firms to get more corporate customers, helping them implement the software directly in the client’s technological stack.

TENSOR9 transforms the software supplier code into the format needed to implement their client in the technological environment. Tensor9 then creates a digital twin of implemented software or a miniaturized infrastructure model of implemented software, so TENSOR9 customers can monitor how the software works in their customer environment. TENSOR9 will help firms to be placed in any premise, from the cloud to a bare server.

Michael Ten-POW, co-founder and general director of TENSOR9, told Techcrunch that the pliability to tendsor9 to send software to any assumption and using digital double technology in order to help in distant monitoring, helps to face out from other firms, comparable to Octopus implementation or non, which also help firms implement software in the client’s environment.

Advertisement

“You can’t just throw the wall software, or it is very difficult to throw the wall software and know what is happening, be able to find problems, debrieve them, fix them,” said Ten-POW (in the photo above, on the left). “They see how it works, they can debate it, can log in and understand what problems are and fix them.”

He said that time is suitable for Tensor9 technology on account of the wind from the creation of AI. Companies and financial institutions wish to simply accept AI technology, but they’ll not risk sending their data to third parties.

“Enterprise search seller can succeed, say, JP Morgan and say:” Hey, I’d love access to your entire six data parabetts to construct an intelligent search layer in order that your internal employees can confer with the company’s given company, “it is not possible to work,” said this-POW.

Ten-Pow, a former engineer in AWS, said he had a “long, quite winding path” to run the tensor9. He came up with the company’s idea, working on one other potential concept that failed. He spent some time, wondering if he would discover an answer to make it easier for software suppliers to accumulate a SOC 2 certificate, a frame compliance frame to help them unlock customers who required their suppliers.

Advertisement

Although it failed, he discovered from clients’ connections that what firms really wanted was software to act in their very own technological environment. But many programming firms, especially startups, shouldn’t have any resources to provide a specially to order for each company customer.

This sentiment became the premise of Tensor9, which Ten-POW began in 2024. Later this 12 months he brought two of his former colleagues, Matthew Michie and Matthew Shanker, as co-founders.

The company found early grip with AI. Since then, they began to expand to work in other industries, including: attempting to get your hands on enterprises, corporate databases and data management. The company currently cooperates with AI, including: 11x, REELL AI and DYNA AI.

TENSOR9 BootstrePPRE for the first 12 months, and recently raised a round of $ 4 million, led by Wing VC with the participation of UP Ventures levels, Devang Sachdev with the Ventures model, Nvangels, Angelic group of former employees of NVIDIA and other Investors of Angels. This POW said that the involvement of investors with this idea was not too difficult, for the rationale that VC they talked to see how their portfolio firms struggle with this exact problem. Tensor9 simply needed to steer investors that they were an appropriate team for work.

Advertisement

“We have a simple model, but there are many complexities under the covers, which makes it happen, difficult technical challenges that we solved to make it happen,” said Ten-Pow. “I think it was one of the things that helped us convince investors to invest in us.”

The company plans to utilize funds for employment and construct one other generation of its technology in order that it could cooperate with clients in larger vertical number.

“There was evolution from (on the premise) to the cloud and we think that this idea of ​​the software lives where it must and works where it must, is the next step, which is a kind of synthesis of previous local and cloud ideas,” Ten-POW said.

(Tagstranslate) artificial intelligence

Advertisement
This article was originally published on : techcrunch.com
Continue Reading

Technology

Kai Cenat teases his University of Streamer, but some influentially warn of the defect in creating content

Published

on

By


Twitch Megastar Kai Cenat confirmed that his once historical “Streamer University” is officially starting, a number of months after the first raising of the concept during the live broadcast of 2025. While the idea already generates noise amongst aspiring creators who’re comfortable to equalize their content of content, some are concerned about the fee for the full -time lifestyle.

According to the price trailer announcing his Streamer University contained a sentence At Hogwarts, a university, which is the scenery of a preferred film and film franchise. In the film, Cenat writes letters to potential streamers, informing them about their selection to the university.

“I am excited that I can introduce you to the most sincere welcome at the first class of Streamer University,” said Cenat. “Here you will find a school where chaos is encouraged and the content is a king … I can’t wait to see you all in the campus for the first semester.”

The original Cenat idea consisted of renting a brick university and mortar to rearrange his classes, but details about these specific logistics, the same to location, dates or exchange materials have not yet been announced; But earlier, he raised the concept that other content creators, the same to Mrbeast or Mark Rober, helping to point free university classes.

Advertisement

The Cenata website, which he created for potential content creators, says that “streamers of all environments” can learn “both unrealized, upcoming and recognized creators.”

However, Mrbeast, which didn’t confirm his commitment, recently warned about the drawback of creating content during the February interview about Steven Bartlett’s podcast.

“If my mental health were a priority, I would not be as successful as I did,” said Bartlett during the discussion.

According to Shira Lazar, co -founder of Creatorcare, a newly launched Soffee service, which goals to help the creators of content in matters of mental health specific to their occupation, often content creators Fight fear, Depression and disordered food, in addition to income fluctuations.

Advertisement

“() Fear of the disappearance of burning fuels in a system, which constantly requires feeding channels. I am like Joan Rivers; I will create until I die, so I want to make sure that I can develop,” said Lazar in an interview.

Amy Kelly, a co -founder of audit health therapy and a licensed family therapist, whose clients consist of many content creators, said The Outlet said that the influencers industry itself just just won’t be built to take care of the creators who feed her.

“Social media is not only a platform – it’s a recruiter,” she said, as she noticed, that 57% of teenagers gene with in the USA He said they’d turn into influential If he receives a likelihood. “We cultivate teenagers in a digital working force with proven threats to mental health – a modern equivalent of sending children to a coal mine without protective equipment.”

As Lazar said in an interview: “The creator’s economy exploded, but the support systems did not meet. Because more gene from this space is professionally entering, we must treat it like a real workplace. This means sustainable systems not only for monetization, but also for mental health.”

Advertisement

)

This article was originally published on : www.blackenterprise.com
Continue Reading
Advertisement

OUR NEWSLETTER

Subscribe Us To Receive Our Latest News Directly In Your Inbox!

We don’t spam! Read our privacy policy for more info.

Trending