LendingTree Investigates Potential Breach in Connection with Snowflake Hacking Campaign
Online lending platform LendingTree Inc. is conducting an investigation into a potential breach linked to a larger hacking campaign targeting clients of Snowflake Inc., a cloud-based data analytics firm. The breach saw a hacking group gain access to the accounts of up to 165 Snowflake customers using stolen login credentials, with demands for ransom payments levied against affected companies. Additionally, data stored by external vendors on Snowflake, including information about students and employees, was stolen.
LendingTree, which uses Snowflake for its operations, was specifically alerted that its subsidiary, QuoteWizard, may have been compromised. However, initial findings suggest that consumer financial account information and data of the parent entity, LendingTree, were not impacted.
Key Takeaways
- LendingTree investigates potential involvement in a large-scale hacking campaign against Snowflake Inc.'s clients.
- Snowflake notified LendingTree that its QuoteWizard subsidiary may have been affected, but consumer financial data appears safe.
- A hacking group used stolen login details to access data from up to 165 Snowflake customers, demanding ransom payments.
- Los Angeles Unified School District confirms data theft from Snowflake, involving student and employee information.
- The school district is collaborating with the FBI and other agencies to investigate the breach, with no direct system breach evidence found.
Analysis
The breach at Snowflake Inc. has exposed vulnerabilities in cloud-based data services, affecting clients like LendingTree and LAUSD. The use of stolen credentials highlights inadequate security practices among users, potentially leading to financial losses, legal repercussions, and increased scrutiny on cloud service providers. The incident emphasizes the need for robust authentication protocols and continuous security monitoring.
Did You Know?
- Snowflake Inc.: A cloud-based data warehousing company providing a platform for data storage, processing, and analytics.
- QuoteWizard: A subsidiary of LendingTree, an insurance comparison marketplace.
- Mandiant: A cybersecurity firm acquired by Google, known for expertise in threat intelligence and incident response services.