Think about the last vendor contract your company ended. It might have been a partner you outgrew, or a service you swapped out when a better deal came along. Someone signed off on the cancellation, the invoices stopped, and everybody moved on to the next thing.
But did anyone take back their access?
In October, an attacker used one vendor’s keys to get into more than a dozen companies. Many of those companies had stopped using that vendor months earlier.
A key left on the ring
Picture one of those companies. At some point a team needed help crunching data, so the company signed up with a cloud data service called Qubole. To make it work, the company gave Qubole a standing key into its cloud, which is how a lot of business software operates.
Eventually the company moved on and the contract ended. The key stayed where it was.
In mid-October, someone else got hold of it. An attacker had stolen the credentials to Qubole’s own cloud account, and those credentials worked on the keys that companies like this one had handed to Qubole. For about two weeks, the attacker used that key to let themselves into the company’s cloud.
Once inside, they took whatever they could reach: the company’s business files, passwords and access keys. In some cases they downloaded entire storage folders in one go. Then they tried the stolen passwords on the company’s other systems, including the ones employees use to sign in to everything else.
Nobody at the company had used that key in months, and nobody was watching it. As far as the company’s systems could tell, an old partner had just stopped by.
Nobody broke in
We say it a lot at Guardian: bad guys don’t hack in, they log in. That’s exactly what happened here.
The attacker didn’t break anything, and no alarm went off. To the companies’ systems, it looked like a trusted vendor using access it had been given, which is what that access was set up for.
These companies didn’t slip up the week of the attack. The decision that hurt them was made much earlier, when they granted the access and never made anyone responsible for taking it back.
Think about what happens when an employee leaves. Someone collects the laptop, shuts off email and deactivates the badge, usually off a checklist. Very few companies have anything like that for a vendor.
What’s at stake for your business
The affected companies haven’t been named, and nobody has reported what the attack cost them. You don’t need their numbers to see where this kind of exposure can lead.
Stolen passwords are usually the start of the next attack, not the end of this one. That next attack can show up weeks later in a completely different part of the business.
If customer or employee information was sitting in those folders, there may be notification requirements, questions from regulators, and a long stretch of rebuilding trust with the people affected.
Your insurer and your bigger customers are likely to ask about this too. Cyber insurance renewals and security questionnaires often ask how you manage vendors and their access, and “we don’t really track it” won’t go over well.
And when something goes wrong because nobody owned the list, people stop asking technical questions and start asking who was responsible. That question lands with leadership.
What to do this month
You don’t need to buy anything to fix this. You need someone to own it.
Three things only you can do
1. Name an owner. Make one person accountable for knowing which outside companies can reach your systems and data. If today’s answer is “IT, probably,” you’ve found the gap
2. Tie vendor offboarding to how contracts close. When a contract ends, taking back the vendor’s access should be part of closing it out, with written confirmation, the same as when an employee leaves.
3. Put it on the leadership calendar. Look at vendor access once a quarter, the way you’d look at any other business risk.
Four questions for your team
1. Which outside companies can reach our systems and data right now
Good answer: “Here’s the list. It shows what each vendor can reach, when they last used it, and who owns it.”
<Red flag: "We'd have to pull that together."
2. When we end a vendor contract, how do we know their access is gone?
Good answer: “Removing access is a required step when a contract closes, and we confirm it in writing.”
Red flag: “IT usually handles that.” Usually isn’t a process.
3. Which vendors still have access they haven’t used in months?
Good answer: “We check unused access every quarter. Here’s what we shut off last time.”
Red flag: “None, as far as we know.” If nobody has checked, nobody knows.
4. If one of our vendors announced a breach tomorrow, how fast could we cut them off?
Good answer: “Within hours. We know what each vendor can reach and who can shut it off.”
Red flag: Anything measured in days, or an answer that starts with “We’d need to figure out…”
The bottom line
There was nothing sophisticated about the Qubole attack. It worked because a door was left open long after everyone stopped thinking about it, and most companies have a few doors like that.
At your next leadership meeting, ask who still has a key to your systems that shouldn’t.
Sources
SecurityWeek: Over a Dozen Organizations Hit in Qubole Supply Chain Attack
CSO Online: Qubole supply chain attack exposed AWS, Entra ID and Okta credentials