Snowflake token theft and cloud data breaches — credentials without MFA

In mid-2024, attackers used stolen customer credentials — often without MFA — to log into Snowflake instances and pull large datasets belonging to major brands. The incident was a wake-up call not because Snowflake was uniquely flawed, but because too many organizations treated cloud data consoles like low-risk internal tools.

The same logic applies to PostgreSQL, Supabase dashboards, and backup buckets. If a password works from anywhere on the internet, someone will sell access to it. ADSA Labs enables MFA on hosting and database providers, uses separate roles for migrations vs application runtime, and avoids sharing one superuser connection string across five projects.

For apps we ship on Supabase, Row Level Security is non-optional for multi-tenant data. Service role keys live only in serverless functions and Route Handlers — never in React client components. We review policies when adding admin impersonation or support tools.

Logging matters: failed auth spikes and unusual export volumes should page someone. Small teams in Sri Lanka, the UK, and the Gulf can adopt the same playbook without a 24/7 SOC — start with MFA, least privilege, and quarterly access reviews.