Learn / Famous incidents explained
The MOVEit breaches (2023)
A single flaw in a popular file-transfer product let one criminal group steal data from thousands of organizations at once. A textbook case of supply-chain risk and extortion without encryption.
What happened
MOVEit Transfer is a managed file-transfer product made by Progress Software, used by companies and agencies to send large or sensitive files securely. In late May 2023 a criminal extortion group known as Cl0p began exploiting a previously unknown flaw (a zero-day, later tracked as CVE-2023-34362) in internet-facing MOVEit servers.
The flaw was a SQL injection vulnerability that let attackers access the database behind the application and steal stored files. The group installed a small web shell on vulnerable servers and downloaded data in bulk over a short period, reportedly around the US Memorial Day holiday weekend when staffing was light.
The scale
The attack did not target one organization. It hit every reachable server running the vulnerable software. Over the following months, thousands of organizations confirmed they had been affected, directly or because a supplier, payroll provider or pension administrator they used ran MOVEit. Victims included government agencies, universities, airlines, banks, health organizations and payroll companies. Tens of millions of individuals had personal data exposed, making it one of the largest data-theft campaigns on record.
| Feature | Why it mattered |
|---|---|
| Zero-day vulnerability | No patch existed when exploitation began |
| Mass exploitation | One flaw, thousands of victims, in days |
| Data theft only | No files were encrypted, so backups did not help |
| Third-party exposure | Many victims had never used MOVEit themselves; their vendors had |
Extortion without ransomware
Cl0p did not encrypt systems. Instead it published a list of victims on its leak site and told them to make contact or have their data published. This is sometimes called pure extortion or data-theft extortion. It showed that backups, while essential against ransomware, do not solve the problem of stolen data. Preventing data from being taken in the first place, and limiting how much sensitive data is kept, matter just as much.
Response
- Progress Software released patches and guidance within days and found further related flaws in the following weeks.
- CISA and the FBI published a joint advisory with indicators of compromise and mitigations.
- The US State Department's Rewards for Justice program offered a reward for information linking Cl0p to a foreign government.
- Many affected organizations sent breach notifications and offered credit monitoring to individuals.
Lessons for organizations
- Know your vendors' vendors. Your data may sit on systems you have never heard of. Ask suppliers what file-transfer and storage tools they use. See vendor risk.
- Minimize internet-facing systems. File-transfer servers exposed to the whole internet are prime targets. Restrict access where possible.
- Delete what you do not need. Files left on transfer servers long after they were delivered increased the damage.
- Plan for zero-days. Monitoring, logging and the ability to quickly take a system offline limit exposure when no patch exists.
- Have a breach notification plan ready, because notification laws set deadlines. See incident response plan.
What individuals should do
If you received a MOVEit-related breach letter, follow the steps in data breaches: verify the letter, accept free monitoring if offered, consider a credit freeze, and watch for phishing that mentions the breach.
