Data from Cloud Storage (T1530): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1530.
- Tactical Phase: Collection.
- Substantiated in 6 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (6)
AT&T Cloud Telecom Call and Text Metadata Exfiltration
Illegal exfiltration of call and text interaction metadata spanning six months for approximately 110 million AT&T wireless customers. Intrusion stemmed from an illicit access point to a third-party Snowflake cloud environment, leading to a 5.7 Bitcoin extortion fee paid through an intermediary to obtain verified video evidence of dataset deletion.
Attackers executed automated queries to pull massive tables containing Call Detail Records (CDRs), phone numbers, interaction counts, and cell tower IDs.
U.S. v. Fujie Wang et al. (Anthem 78.8M Patient Record Breach)
Chinese state-affiliated threat actors conducted spearphishing campaigns against Anthem health insurance subsidiaries, deploying customized backdoors to penetrate enterprise data warehouses and exfiltrate 78.8 million personal health and identity records.
Threat actors queried the unencrypted Oracle enterprise data warehouse containing tens of millions of health plan subscriber records.
Okta Customer Support Console Intrusion (LAPSUS$)
Teenage cyber extortion collective LAPSUS$ compromised a third-party customer support contractor (Sitel) workstation via an active RDP session, gaining access to Okta SuperUser administrative diagnostic tools affecting 366 enterprise tenants.
Attackers searched for high-profile corporate accounts, attempting to view multi-factor reset logs and customer tenant identities.
LastPass DevOps Engineer Home Breach & Vault Exfiltration
Adversaries compromised a senior DevOps engineer home computer by exploiting a remote code execution vulnerability in Plex Media Server, implanted keyloggers to capture master vault credentials, and exfiltrated encrypted customer password vaults from AWS S3 storage.
Armed with master credentials and AWS access keys from the engineer home workstation, attackers accessed cloud storage (AWS S3) buckets.
U.S. v. Joseph Sullivan (Uber Breach Extortion Cover-up)
Historic federal criminal prosecution of former Uber Chief Security Officer Joseph Sullivan for obstruction of justice and misprision of a felony after concealing a massive breach of 57 million user and driver records by paying $100,000 in Bitcoin through a bug bounty program under non-disclosure agreements.
"Threat actors accessed Uber private Amazon S3 cloud storage buckets housing unencrypted databases containing 57 million customer records and 600,000 driver license numbers."
Prudential Financial ALPHV BlackCat Cloud Tenant Compromise
Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.
"Attackers exfiltrated limited administrative files and employee directory metadata from corporate cloud storage before containment."