In the spring of 2024, customers of the cloud data platform Snowflake started reporting data theft. Ticketmaster. Santander. AT&T. Advance Auto Parts. By the time Mandiant finished its investigation, at least 165 organisations were affected and hundreds of millions of records were on the market.
Our own Threat Detection & Research team has since traced the full arc of the group behind it, from the Snowflake intrusions to the ShinyHunters extortion operation that followed. Their write-up on ShinyHunters is worth your time. But what's striking, reading it, is how unremarkable the initial technique was. No vulnerability in Snowflake itself. The attackers, tracked as UNC5537, had simply bought credentials. Those credentials had been harvested by infostealer malware, in some cases years earlier, from the personal and contractor machines of people who had logged into Snowflake. Some of the logs dated back to 2020. The accounts had no multi-factor authentication, the passwords had never been rotated, and the attackers walked in.
At Sekoia, we watched this unfold with a particular discomfort. Our TDR team could document everything about the actors: their forum handles, their infrastructure, their extortion playbook, the 1.3 TB Ticketmaster listing priced at $500,000. All of it accurate. All of it too late for the 165 companies whose data was already gone.
What those companies needed was something we couldn't give them. They needed to know, months earlier, that an employee's Snowflake login was sitting in a stealer log on a Telegram channel. That isn't threat intelligence. That's exposure.
Today, we are. Sekoia Digital Risk monitors the places where stolen identities are traded and matches what it finds against your organisation, inside the same platform as your threat intelligence. Had it existed in 2020, when those first Snowflake credentials were harvested, the alert would have read: corporate credential for your domain found in stealer log, source Telegram, collected today. Four years before anyone used it.
Here's why we built it, and what it changes.
The gap we'd been living with
For years, Sekoia Intelligence has answered one question well: who is targeting you, and how? Our analysts track intrusion sets, map their infrastructure, dissect their malware and publish the indicators that let your detection stack catch them. It's good work and customers rely on it.
But the Snowflake post-mortem wasn't an outlier. Over the past two years, almost every major breach report we read started the same way. Not with a zero-day. Not with a clever exploit. With a password that had already been stolen, already been sold and already been sitting in a criminal's hands for days, weeks or months before anyone used it.
Our intelligence could tell you about the group that eventually walked in. It couldn't tell you that the door had been unlocked all along.
The pattern repeats
Once you see the shape of the Snowflake story, you start seeing it everywhere.
1. Uber, September 2022
An attacker claiming to be part of Lapsus$ bought the corporate credentials of an external contractor on the dark web. The contractor's account did have MFA, so the attacker sent push notifications until the contractor, worn down, accepted one. From there, the attacker found hard-coded admin credentials on an internal network share and ended up with access to Uber's AWS, Google Workspace, Slack and bug bounty systems. Our team wrote about Lapsus$ earlier that year, when the group was already buying credentials and brute-forcing its way into some of the largest companies in the world
2. CircleCI, January 2023
An engineer's laptop was infected with infostealer malware. Endpoint protection didn't catch it. The malware stole a session cookie for a corporate account that had completed two-factor authentication. The attackers replayed that cookie and were inside with the same access the engineer had. The MFA never fired, because the session had already passed it. CircleCI had to ask every customer to rotate every secret stored on the platform.
3. Okta, October 2023
An Okta employee signed into their personal Google account on an Okta-managed laptop. Their browser synced saved credentials, including the username and password of a service account for Okta's customer support system. Those credentials ended up compromised, and an attacker used them to access support case files, which contained session tokens uploaded by customers. The breach reached 134 customers, including 1Password, BeyondTrust and Cloudflare. A personal account, a synced password and no exploit. The group most associated with attacks on Okta tenants that year, Scattered Spider, is one our team has tracked closely, and its whole playbook rests on identity rather than exploits.
Three breaches, three different organisations, three different threat actors. In every single one, the first step was a stolen identity that had been in circulation before the attack began.
Why threat intelligence alone can't see this
It's worth being precise about why this is a gap and not a failure of CTI.
Threat intelligence is organised around the adversary. We follow intrusion sets, we catalogue their tooling and infrastructure, we write detection rules for their behaviour. That's the right thing to do, because it scales. One well-documented intrusion set protects thousands of organisations.
But stolen credentials don't belong to the adversary. They belong to you. A stealer log containing one of your employees' passwords is a fact about your organisation, not about any particular threat actor. The person who stole it may never use it. They may sell it to someone who sells it again. The group that eventually logs in may be one we've never seen before.
So the question "who is targeting me?" and the question "what of mine is already out there?" require different data, different collection and different matching. The first is about the threat landscape. The second is about your footprint in it. We'd built the first. We hadn't built the second.
The scale of the second problem is also larger than most people assume. Our team has spent years inside the infostealer economy: the malware, the distribution networks, the traffers who spread it and the logs they produce. Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest every saved password, every active browser session and every autofill record. Those logs are packaged and sold on Telegram, often for a few dollars, sometimes for free. The 2025 Verizon Data Breach Investigations Report found that 88% of web application attacks involved stolen credentials, and that nearly half of the stealer logs containing corporate logins came from devices the company didn't manage. Your endpoint tools never see the infection. Your identity provider sees a valid login.
We understood the supply chain. We weren't checking whether our customers were in it.
What Sekoia Digital Risk does
Sekoia Digital Risk monitors the places where stolen identities and corporate data are traded, and matches what it finds against what belongs to you.
You tell it what to watch: your domains, employee usernames, brand terms and executive names. It then matches those identifiers continuously against data collected from stealer logs, dark web forums and markets, ransomware leak sites and Telegram channels. When something matches, it raises an alert in the Sekoia platform with the source, the exposed data and the surrounding context.
In practice, that means:
- Leaked credentials and live sessions. When an employee's corporate password or an active session cookie shows up in a stealer log, you know, with the source and the date. This is the CircleCI and Snowflake scenario, caught before the login.
- Mentions in criminal channels. When an access broker advertises VPN access to your organisation, or your domain appears in a combolist, you see it. This is the Colonial and Uber scenario: the credential was for sale, and nobody was looking.
- Brand and executive exposure. When your executives' credentials or personal data appear in a leak, or your brand is being discussed in channels that trade in fraud, you're told.
- Investigation. Analysts can search across years of archived underground content to understand how an exposure happened and who else is affected.
The collection behind this is powered by Flare, whose researchers and automated collection cover more than 150 million stealer logs, 127,000 Telegram channels and 390 cybercrime forums. We chose to partner rather than build because collection of this kind takes years to establish, and our customers didn't have years.
Where the two halves meet
Consider the Okta breach again. On its own, an alert that a service account password has appeared in a stealer log is a useful fact. Combined with Sekoia Intelligence, it becomes a story: which infostealer family harvested it, which actors buy from that family, what they typically do with support-system access, and which detection rules to turn up in Defend while you rotate the credential.
Or run it the other way. When our TDR team publishes a report like the ShinyHunters investigation, Digital Risk lets you ask the obvious next question: is my organisation in their inventory?
That's what we mean by the whole picture. Sekoia Intelligence tells you who is targeting you and how they operate. Sekoia Digital Risk tells you what they already hold. Neither is complete alone.
What we're not claiming
A quick note on scope, because the market around this is noisy.
Sekoia Digital Risk finds exposures and gives your team what it needs to act. It doesn't reset passwords, revoke sessions or file takedown requests for you. Those decisions depend on your identity provider, your change process and your risk appetite, and in our experience security teams want to own them. What they don't want is to find out from an incident responder that the credential had been for sale for six months.
We're also starting with what we know works: credentials, sessions, underground mentions and brand exposure, delivered in the platform you already use. There's more to come, but we'd rather ship something accurate than something broad.
Getting started
Sekoia Digital Risk is available now on top of Sekoia Intelligence, priced by the number of employees monitored. If you're an existing customer, your account team can walk you through what it would find for your domains. If you're not, we'd be glad to show you both halves of the picture together.
The first Snowflake credentials were stolen in 2020 and used in 2024. That's four years in which someone could have been looking. Now someone is.
