A threat actor used compromised IAM credentials for Qubole's AWS account to assume roles in AWS environments of tens of companies between October 14 and 26, Wiz researchers found. The attacker retrieved secrets and downloaded data from accessible S3 buckets, and Sentra said dozens of victims were affected, with millions of files stolen from one customer.