Advance Auto Parts Data Breach

In 2024, Advance Auto Parts was among dozens of companies affected by a broad campaign targeting Snowflake cloud storage customers. The attackers, tracked by Mandiant as UNC5537, used stolen credentials to access Snowflake instances lacking multi-factor authentication. Advance Auto Parts confirmed that 2.3 million records were compromised, including customer names, email addresses, phone numbers, and employee data such as names and Social Security numbers of current and former employees.

Advance Auto Parts is a leading automotive aftermarket parts retailer with over 4,700 stores in the United States and Canada.

Attackers used credentials obtained from info-stealer malware infections targeting Snowflake employees and customers. The compromised Snowflake instances lacked MFA and had network access controls that were insufficiently restrictive. Once inside, attackers exfiltrated data using Snowflake's own COPY INTO commands to transfer data to attacker-controlled storage.

UNC5537 (Mandiant designation) is a financially motivated threat actor group that systematically targeted Snowflake customer instances. They operated with patience and sophistication, using stolen credentials rather than exploiting technical vulnerabilities, demonstrating the effectiveness of credential-based attacks against poorly configured cloud services.

Aliases

• Snowflake Attacker
• UNC5537

MITRE groups

• UNC5537

Attribution sources

• Mandiant investigation
• Snowflake disclosure
• Media reports

Exposure of customer PII and employee SSNs created risks of identity theft and targeted phishing. Advance Auto Parts faced potential regulatory actions under state data breach notification laws.

Evidence of breach

The attackers attempted to extort Advance Auto Parts and posted samples of the stolen data online. Mandiant confirmed the breach as part of a coordinated campaign.

Additional victims

• Snowflake (cloud provider)

Countries affected

• United States
• Canada

Data types

• Customer Names
• Email Addresses
• Phone Numbers
• Physical Addresses
• Employee Names
• Employee SSNs
• Purchase History

Costs included incident response, customer notification, legal fees, and potential regulatory penalties.

Public reaction

Concern among customers and employees about the exposure of SSNs and the broader Snowflake supply chain risk.

Political impact

Contributed to regulatory scrutiny of cloud security practices and MFA requirements for enterprise data platforms.

Potential class-action lawsuits and regulatory investigations under state and federal data protection laws.

Policy changes

• Snowflake mandated MFA for all customer accounts following the breach campaign

Security improvements

• MFA enforcement on cloud data platforms
• Credential rotation and monitoring for info-stealer infections

Significance

The Advance Auto Parts breach was part of one of the largest cloud data theft campaigns in 2024, demonstrating the cascading risks of credential theft targeting cloud infrastructure providers.

Legacy

Contributed to industry-wide implementation of mandatory MFA on cloud data platforms and increased awareness of info-stealer malware risks targeting enterprise cloud credentials.

Publishing organisations

• BleepingComputer
• Mandiant
• TechCrunch
• Bloomberg

Related events

• 2024-snowflake-data-breach-2024
• 2024-ticketmaster-breach-2024
• 2024-change-healthcare-attack

Advance Auto Parts engaged incident response teams, notified affected individuals, and implemented enhanced security measures including MFA on all cloud accounts.

Official documents

• Advance Auto Parts data breach notification to regulators

References

1. [1]Mandiant investigation report
2. [2]BleepingComputer
3. [3]TechCrunch
4. [4]Snowflake security advisory