Snowflake’s service account breach shows why NHI governance failed

At a glance

What this is: This is a breach analysis of the Snowflake incident, showing how exposed service account credentials became the entry point for large-scale customer data theft.

Why it matters: It matters because service accounts sit inside the same identity governance model as humans and need inventory, ownership, rotation, and privilege controls that match their blast radius.

By the numbers:

• 165 different organizations were victims of the Snowflake-focused attack.
• The attackers claim that around 30 million Santander Bank clients' bank details were exposed.

Context

Snowflake’s service account breach shows what happens when non-human identities are treated as secondary accounts rather than governed access paths. In this case, exposed service account credentials were enough to let attackers move into production systems and reach customer data at scale.

The governance gap was not that an identity existed, but that its ownership, authentication strength, and lifecycle controls were not tight enough to prevent reuse after exposure. For NHI programmes, this is a reminder that service accounts need the same inventory discipline and privilege scrutiny as human identities, with more urgency because their access is often broader and less visible.

Key questions

Q: What breaks when service accounts are not classified correctly?

A: When service accounts are not classified correctly, teams apply the wrong control tier to the wrong identity. That can mean over-vaulting low-risk accounts, missing high-risk production accounts, or setting rotation and monitoring policies that do not match the account’s real business function.

Q: Why do hard-coded service account credentials create such a high breach risk?

A: Hard-coded credentials are dangerous because they are easy to copy, reuse, and pivot across systems once exposed. If the same secret is shared among teams or stored in code, a compromise can give attackers broad access beyond the original application. Short-lived credentials and rotation reduce that window and make reused secrets far less valuable.

Q: What are the signs that NHI privilege is wider than teams realise?

A: Look for recursive role inheritance, service accounts with passwords instead of stronger key-based authentication, and external identities that bypass the normal identity provider path. Those signals usually mean the effective access path is broader than the direct assignment suggests and deserves review before it is abused.

Q: Who should own service account risk under NHI governance?

A: Every service account needs an accountable owner who can explain why it exists, what it accesses, and when it should be retired. Without that ownership, rotation, review, and offboarding become partial tasks with no clear decision-maker, which is exactly how stale access persists after the business need has changed.

Technical breakdown

How exposed service account credentials became the initial foothold

The article describes a classic NHI compromise path: credentials were exposed through infostealer malware and then reused against a production environment. A service account is a non-human identity used for application or system access, and it often bypasses the interactive controls used for people. When those credentials are long-lived or weakly protected, the attacker does not need to break the platform itself. They only need one valid identity path. That makes the exposure of a service account materially different from a generic data breach, because the credential becomes the mechanism of access, not just a supporting artefact.

Practical implication: treat exposed service account credentials as live access, not as historical exposure.

Why standing privilege turns credential theft into broad reach

Snowflake’s role model allowed privileges to cascade through linked roles, which means a single identity can inherit more access than its direct assignment suggests. In NHI terms, standing privilege is the condition that turns one stolen credential into a larger operational blast radius. If the account can authenticate with a password or key and already has access to sensitive objects, the attacker inherits that access immediately. The technical problem is not only authentication, but authorisation depth and privilege recursion. Without clear separation between human and service identities, teams can miss how much access the account actually carries.

Practical implication: map effective privileges, not just direct assignments, for every service account.

Why lifecycle gaps make service account compromise persistent

The article’s emphasis on old exposed credentials points to a lifecycle failure, not a one-time control miss. A service account should be discoverable, owned, reviewed, and rotated like any other production identity. When ownership is unclear, credentials can survive for years after the business need has shifted. That is especially dangerous in cloud services where third-party integrations, contractor access, and inherited roles make offboarding easy to overlook. In practice, the compromise persists because the account remains valid long after the original trust decision aged out.

Practical implication: bind every service account to an owner, rotation cadence, and offboarding trigger.

Threat narrative

Attacker objective: The attacker’s objective was to use valid NHI credentials to reach and extract customer data from multiple organisations through one production access path.

1. Entry occurred through service account credentials exposed by infostealer malware and reused against Snowflake production access.
2. Credential abuse gave the attacker legitimate access to the environment rather than forcing an exploit against the product itself.
3. Privilege depth and reusable access paths expanded the blast radius across customer data and downstream organisations.
4. Impact included compromise of data from 165 organisations and claims of millions of exposed customer records.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Service account governance failed because the identity was treated as a technical helper, not a production subject. The Snowflake case shows that a non-human identity can carry enough authority to become the primary breach path when its lifecycle is under-governed. That makes ownership, inventory, and entitlement review core security controls, not administrative tasks. The practitioner conclusion is simple: if the identity can reach production data, it belongs in the same governance model as any other high-risk access path.

Ephemeral exposure is not the same as low risk when the credential can be reused at scale. The article shows that one exposed service account can become a shared liability across many organisations because cloud trust chains are reusable. This is where NHI governance differs from application security: the issue is not a buggy workload, but a valid identity that outlived its intended trust boundary. The practitioner conclusion is to measure NHI risk by blast radius, not by whether the access looks automated.

Identity visibility without identity classification leaves a false sense of control. Snowflake’s later move to distinguish SERVICE identities points to a broader governance problem: if humans and service accounts are lumped together, policy enforcement stays partial. The named concept here is service account classification debt: the gap between having identity data and being able to govern the identity type correctly. The practitioner conclusion is that NHI programmes must classify first, then enforce policy.

The real control failure was stale access persistence, not simply stolen credentials. The oldest exposed credentials were over four years old, which shows how long-lived NHI access can remain valid after the original business use has faded. That is a lifecycle failure with direct breach consequences, because standing access gives an attacker a durable foothold once the secret is found. The practitioner conclusion is that credential age must be a governance signal, not just an audit metric.

This breach validates the NHI governance model as a board-level issue, not a cloud-specific edge case. The article ties one exposed service account to data exposure affecting major organisations and millions of customers. That scale matters because it shows service account risk can produce customer harm, regulatory exposure, and trust loss at the same time. The practitioner conclusion is to place NHI governance inside enterprise risk management, not keep it isolated in platform operations.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• 1 in every 1,000 non-human identities in enterprise environments is more than 10 years old.
• Read next: Guide to NHI Rotation Challenges

What this signals

Service account classification debt: the Snowflake case shows that identity governance fails when non-human identities are still treated as exceptions rather than as a first-class population. Programmes that cannot separate human and service accounts will keep missing where access actually lives and who is responsible for it.

Access reviews are only useful when the identity can be tied to a current owner and a current business need. When service accounts persist for years, the control shifts from review to issuance discipline, which is where NHI governance has to be strongest.

For practitioners

• Classify service accounts separately from human users Build a distinct inventory for non-human identities so policy, review, and ownership can be applied to the account type that actually holds production access.
• Rotate exposed or long-lived credentials on a fixed cadence Prioritise service accounts with passwords or keys that have persisted for years, and shorten the window in which a stolen secret remains useful.
• Map effective privilege chains, not just direct role grants Trace recursive role inheritance and downstream permissions so you can see what one compromised service account can actually reach.
• Assign an accountable owner to every service account Tie each NHI to a named business or technical owner who can approve changes, validate necessity, and trigger offboarding when the integration is no longer required.
• Review third-party and contractor access as a separate risk class Check whether externally managed identities still need access, whether network policy applies, and whether the account should remain active at all.

Key takeaways

• The breach shows that service accounts can be the primary path into production data when governance treats them as secondary identities.
• The article says 165 organisations were affected and that some exposed credentials were over 4 years old, which points to a long-lived access problem.
• The control that would have limited this most directly is better NHI classification, ownership, and rotation discipline around service accounts.

Key terms

• Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.