Advance Auto Parts tied up in Snowflake breaches
Add Axios as your preferred source to
see more of our stories on Google.
An Advance Auto Parts store in Van Nuys, California. Photo: Eric Thayer/Bloomberg via Getty Images.
Advance Auto Parts is investigating a potential data breach linked to the recent Snowflake cyber incident, a spokesperson said yesterday.
Why it matters: A recent listing on a dark web hacker forum suggests that malicious actors may have stolen information about at least 380 million customers from the automotive supply retail chain.
What they're saying: "We are aware of reports that Advance may be involved in a security incident related to Snowflake," Advance spokesperson Darryl Carr told Axios. "We have not experienced any impact to our operations or systems."
The big picture: Hackers have been targeting cloud computing company Snowflake's customers who didn't have multi-factor authentication turned on.
- Snowflake has said that a recent string of data breaches was not tied to a vulnerability on its systems, company breach or product misconfigurations.
- Ticketmaster has said that a recent data breach affecting at least 500 million people was tied to a database stored with Snowflake.
- TechCrunch reported this week on the discovery of a dark web database that appears to include legitimate Snowflake customers' credentials, stolen via infostealer malware.
Zoom in: Hackers claim they've stolen roughly 3 terabytes of information from Advance Auto Parts.
- The stolen data trove allegedly includes information about 358,000 employees, 44 million loyalty and gas card numbers, 140 million customer orders and 380 million customer profiles, including phone numbers and addresses.
Threat level: Like most data breaches, the stolen data could put customers and employees at a higher risk of identity theft and fraud.
- Hackers can also use stolen passwords to break into other accounts if a user has reused the compromised login credentials.
What we're watching: Advance Auto Parts is a publicly traded company subject to new SEC cyber incident reporting rules — meaning it will need to file a publicly available report about the breach if it has a material impact.
