Desk live·
ForensicPost
Breaches/Retail/File 24-0716

Advance Auto Parts Notified 2,316,591 People After Snowflake Theft

The retailer put an exact figure on its share of the Snowflake campaign. Most of those affected were job applicants rather than customers.

Constructed geometry · not a chart of case data
JurisdictionUSAthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetAdvance Auto Parts
ActorUNC5537
S. Rosler8 min readConfidence: high2 sources reviewed

Advance Auto Parts reported that 2,316,591 people were affected by data taken from its environment on a third-party cloud platform, in one of the intrusions linked to the campaign filed at 24-0602. Reporting describes the affected population as consisting largely of current and former employees and job applicants, with social security numbers and government identification numbers among the fields.

An Applicant Is Not A Customer

Somebody who applied for a job at a parts retailer and was not hired has no ongoing relationship with the company, may not remember applying, and handed over a social security number to be considered.

Recruitment data is collected once, retained indefinitely and almost never inventoried. It sits in the same warehouse as sales analytics because that is where data goes.

An Exact Number Is Worth Noting

The figure is 2,316,591, not "approximately 2.3 million". That precision means the company reconstructed which individuals were in the affected tables rather than estimating from a row count.

Most disclosures in this database do not reach that standard, and the ones that do are usually the ones that took longest to produce.

How we reported this

Compiled from the company’s regulatory notifications and public reporting, listed below. The characterisation of the population as largely employees and applicants is as reported. Corrections: corrections@forensicpost.com.

Sources
  1. Millions Impacted by Breach at Advance Auto Parts Linked to Snowflake IncidentSecurityWeek
  2. Advance Auto Parts: Data of 2.3 Million People Stolen in BreachSecurity Boulevard
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary