{
  "slug": "bulk-export-needs-a-signature",
  "title": "The credential was valid. The export was 100 million records.",
  "summary": "The Snowflake campaign was not a platform breach. Every login succeeded. Why bulk export is an authorization problem, and what a signed export looks like.",
  "lede": "The 2024 campaign against cloud data warehouse tenants is remembered as a breach and taught as an MFA lesson. It was neither. Every authentication succeeded, the platform was not compromised, and the thing nobody asked was whether a human meant to export the customer table.",
  "date": "2026-09-11",
  "reading_time": "17 min read",
  "category": "Security",
  "tags": [
    "Snowflake breach",
    "infostealer",
    "session cookie theft",
    "data exfiltration",
    "bulk export",
    "step-up authentication",
    "UNC5537"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Bulk%20Export%20Control/1200_630/blog.jpg",
  "url": "/blog/bulk-export-needs-a-signature.html",
  "wordcount": 4409,
  "related": [
    "session-theft-aitm",
    "authority-graph",
    "identity-failure-map"
  ],
  "schema": "Article"
}