A data breach potentially affecting as many as 560 million Ticketmaster accounts and a confirmed one for Santander Bank may have stemmed from attacks on the cloud storage accounts with a company called Snowflake. As spotted by Bleeping Computer, an investigation from cybersecurity firm Hudson Rock reports that a bad actor gained access to Ticketmaster and Santander by using the stolen credentials of a single Snowflake employee.

According to Hudson Rock, the hacker bypassed the authentication service Okta using these credentials and then generated session tokens to obtain a trove of information from Snowflake. In addition to Ticketmaster — which publicly acknowledged the breach later on Friday evening — and Santander Bank, Hudson Rock suggests the hacker may have gained access to hundreds of other Snowflake customers. A few of the major brands that use the cloud storage service include AT&T, HP, Instacart, DoorDash, NBCUniversal, and Mastercard.

The threat actor involved appears to be a hacking group called ShinyHunters, which attempted to sell Ticketmaster’s data on the dark web for $500,000, according to Bleeping Computer. ShinyHunters also claimed responsibility for the Santander breach and put information said to belong to over 30 million customers up for sale.

Snowflake has seemingly disputed Hudson Rock’s findings in its most recent response, saying that while investigating “potentially unauthorized access to certain customer accounts,” it “observed increased threat activity beginning mid-April 2024 from a subset of IP addresses and suspicious clients we believe are related to unauthorized access.”

More details on those findings are available here, but the company says that while a bad actor accessed a “demo account” belonging to a former employee, it didn’t contain sensitive information. It claims that “To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product.”

Even before Ticketmaster confirmed the breach, malware tracker vx-underground said it could assert “with a high degree of confidence” that the leaked data is legitimate. It notes that some of the leaked information dates back to the mid-2000s and includes full names, emails, addresses, phone numbers, hashed credit card numbers, and more.

Earlier this month, Santander published a statement to confirm that “certain information” of customers in Chile, Spain, and Uruguay had been accessed. The Verge reached out to Ticketmaster and Santander with requests for comment but didn’t immediately hear back.

Update, May 31st: Noted that Live Nation has now confirmed the data breach.