One SQL injection flaw in a file-transfer tool ended up exposing the personal data of about 93.3 million people. More than 2,700 organizations were hit.
The tool is MOVEit, a managed file transfer product made by Progress Software’s Ipswitch unit. Banks, health systems and government agencies use it to move large volumes of sensitive files. A customer reported unusual activity on May 28, 2023, and the vulnerability turned out to be a zero-day. Mandiant says attackers began using it on May 27. Progress released a patch on May 31.
How the attack worked
The ransomware group CL0P exploited the flaw through SQL injection against public-facing MOVEit servers and stole files using a custom web shell called LEMURLOOT. The US Cybersecurity and Infrastructure Security Agency and the FBI have said the group is Russian-affiliated.
The damage spread because of what MOVEit does. Organizations use it to exchange data with partners and customers, so one compromised server often held records from dozens or hundreds of other entities. A breach at one vendor, Pension Benefit Information, exposed data on at least 2 million people downstream. The National Student Clearinghouse attack exposed data from more than 800 US colleges and universities.
Who was hit
The list grew through June 2023.
- June 3: the Government of Nova Scotia estimated up to 100,000 current and former employees were affected.
- June 5: the BBC, British Airways, Boots, Aer Lingus and the payroll provider Zellis were named as victims.
- June 6: CL0P claimed responsibility on its dark web site and said it had deleted stolen government data. That claim was later disproved.
- June 12: Ernst & Young, Transport for London and Ofcom said they were affected. Ofcom said personal and confidential information had been downloaded.
- June 15: CNN reported that the US Department of Energy was among federal bodies hit. A day later, the Louisiana Office of Motor Vehicles and Oregon’s Driver and Motor Vehicle Services were reported hit, affecting millions of residents.
Emsisoft, which kept a running count, put the number of known organizations above 2,500 by October 25, 2023, with more than 80 percent based in the US. By August 2024 it estimated 2,773 organizations and nearly 96 million people.
Response and aftermath
CISA, CrowdStrike, Mandiant, Microsoft, Huntress and Rapid7 helped with incident response. Industry experts credited the MOVEit team for quick patches, and most customers applied them quickly.
The Securities and Exchange Commission subpoenaed Progress Software on October 2, 2023, for documents about the vulnerability. In August 2024, Progress said the SEC had closed the inquiry and did not plan to recommend enforcement action.
Security vendors have used MOVEit as a case study since. Aviatrix argues that tighter network segmentation and limits on outbound connections could have kept attackers inside a small area. It cites Verizon’s 2025 breach report, which found that breaches involving a third party doubled from 15 percent to 30 percent in a year.
