Topic starter
06/07/2026 9:40 am
TL;DR: Snowflake’s 2024 compromise showed how exposed service account credentials, not a product flaw, can drive wide-scale customer data loss, with attackers using stolen NHI access to hit 165 organisations and millions of records, according to Token Security’s analysis. The lesson is that identity visibility, credential rotation, and ownership mapping matter more than assuming machine access is inherently low risk.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “The Hidden Threats of Non-Human Identities: Lessons from Snowflake's Attack”.
By the numbers:
- 165 different organizations were victims of the Snowflake-focused attack.
- The attackers claim that around 30 million Santander Bank clients' bank details were exposed.
Key questions
Q: What breaks when service accounts are not classified correctly?
A: When service accounts are not classified correctly, teams apply the wrong control tier to the wrong identity.
Q: Why do hard-coded service account credentials create such a high breach risk?
A: Hard-coded credentials are dangerous because they are easy to copy, reuse, and pivot across systems once exposed.
Q: What are the signs that NHI privilege is wider than teams realise?
A: Look for recursive role inheritance, service accounts with passwords instead of stronger key-based authentication, and external identities that bypass the normal identity provider path.
Practitioner guidance
- Classify service accounts separately from human users Build a distinct inventory for non-human identities so policy, review, and ownership can be applied to the account type that actually holds production access.
- Rotate exposed or long-lived credentials on a fixed cadence Prioritise service accounts with passwords or keys that have persisted for years, and shorten the window in which a stolen secret remains useful.
- Map effective privilege chains, not just direct role grants Trace recursive role inheritance and downstream permissions so you can see what one compromised service account can actually reach.
Bottom line: The breach shows that service accounts can be the primary path into production data when governance treats them as secondary identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:55 am
Service account governance failed because the identity was treated as a technical helper, not a production subject. The Snowflake case shows that a non-human identity can carry enough authority to become the primary breach path when its lifecycle is under-governed. That makes ownership, inventory, and entitlement review core security controls, not administrative tasks. The practitioner conclusion is simple: if the identity can reach production data, it belongs in the same governance model as any other high-risk access path.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 1 in every 1,000 non-human identities in enterprise environments is more than 10 years old.
A question worth separating out:
Q: Who should own service account risk under NHI governance?
A: Every service account needs an accountable owner who can explain why it exists, what it accesses, and when it should be retired. Without that ownership, rotation, review, and offboarding become partial tasks with no clear decision-maker, which is exactly how stale access persists after the business need has changed.
👉 Read our full editorial: Snowflake’s service account breach shows why NHI governance failed