A major cybersecurity wake-up call has been issued by Snowflake, one of the leading cloud-based data warehousing and analytics platforms, as it completes its three-phase authentication rollout, effectively ending password-based service-account logins. This move comes on the heels of a high-profile hacking case that exposed billions of records, including sensitive customer information from AT&T’s wireless customers.
The hacking incident, which led to the guilty plea of Connor Moucka and his co-conspirators, highlighted a crucial identity failure: outdated credentials, lack of second-factor authentication, and weak network restrictions. Snowflake is now tackling this “identity debt” by shifting its focus to non-human identities, specifically service accounts that were previously allowed to authenticate with passwords.
The platform’s deprecation process has been divided into three phases, with the final phase targeting legacy service accounts that still rely on password-based authentication. As of September 2025, human users had to provide a second factor in Snowsight, while non-human users created after May 2026 were automatically assigned to the SERVICE type, which does not support password storage.
However, the real challenge lies ahead as Snowflake’s customers are forced to confront their own identity management issues. The accounts that still have passwords will soon be blocked from authenticating with them, and existing legacy accounts will need to be migrated to the SERVICE type. This is where the hard part begins – discovering what each account is used for, assigning an owner, and determining how much access it still needs.
The process of migrating service accounts requires a thorough understanding of their dependencies and usage patterns. Snowflake’s ACCOUNT_USAGE schema provides some insight into which accounts are still signed in with passwords, but this information only scratches the surface. Customers will need to answer three key questions for every service account:
* Which ones authenticate to Snowflake?
* Who owns each one?
* What breaks when the password stops working?
To address these questions, customers must build a comprehensive inventory of their service accounts, including their usage patterns and dependencies. This is not a one-time task but an ongoing process that requires continuous monitoring and maintenance.
One of the most critical steps in this process is attaching a named owner to each account. This ensures that someone is accountable for deprovisioning the account as much as ensuring its uptime. Where ownership remains unclear, a controlled disable window should be used before deletion to prevent orphaned accounts from causing issues down the line.
Finally, Snowflake offers four methods for password-less authentication, including workload identity federation, which is recommended due to its secretless nature and low operating costs. However, each account may require a different approach, depending on its specific needs and dependencies.
In conclusion, Snowflake’s authentication rollout serves as a wake-up call for all organizations that have been neglecting their identity management practices. The challenge ahead is not just technical but also organizational – requiring a culture shift towards responsible identity governance and continuous monitoring of service accounts. By following these steps and adopting best practices in identity management, organizations can minimize the risk of similar security breaches and ensure the integrity of their data assets.
Source: Bleeping Computer — 2026-08-26