Progress Software published the bug on May 31, 2023, and fixed it the same day. It was too late. The flaw, an SQL injection hole tracked as CVE-2023-34362, sat in MoveIt Transfer, a managed file transfer product, and attackers were already inside customer systems.
Rapid7 and other security vendors soon reported active exploitation. Microsoft pinned the attacks on a group it calls “Lace Tempest,” which it linked to the Clop ransomware gang. Clop’s method was data extortion: steal what a vulnerable MoveIt server held, then demand payment.
The first confirmed victims
Disclosures came quickly. Zellis, a UK software provider for HR teams, said “a small number of our customers have been impacted.” British Airways confirmed its breach began downstream, through Zellis. The BBC and the retailer Boots confirmed attacks too.
Nova Scotia’s government put the exposure at as many as 100,000 past and present public employees. Investigators found that social insurance numbers, home addresses and bank details had been taken, because the province pushed payroll data through the MoveIt service. The University of Rochester disclosed a breach on June 2 and said the vulnerability had touched “approximately 2,500 organizations worldwide.”
Clop set its own timetable. It said it would start posting victims’ names on its leak site if they had not made contact by June 14. It also claimed it had erased data belonging to government agencies, city services and police departments.
The count keeps climbing
By late September the picture had changed. Emsisoft, which tracked the campaign from the start, counted 2,095 organizations and 62,054,613 individuals. Analyst Brett Callow had been following about 270 organizations in July. Emsisoft drew on notices filed with states, SEC paperwork, other disclosures and Clop’s own website, and TechTarget noted that the criminals’ data cannot be trusted, so the figure is an estimate, not a confirmed count.
The biggest contributors: Maximus with 11 million, the Louisiana Office of Motor Vehicles with 6 million and Alogent with 4.5 million. Callow said 1,690 of the 2,098 known victim organizations were hit through third parties. Colorado’s health care financing department, for one, lost Medicaid beneficiary data through a MoveIt instance run by its contractor IBM.
Censys researcher Emily Austin called it a supply chain problem. One instance, she explained, “could hold data for tens or hundreds of other organizations.” The National Student Clearinghouse disclosed that data for nearly 900 colleges and universities had leaked.
Courts and regulators
By October, Progress told the SEC it was party to 58 class action lawsuits, which a judicial panel had ordered combined in a federal court in Massachusetts. A total of 23 customers had sent letters seeking indemnification. The company said it had received an SEC subpoena ten days earlier, described by the agency as a fact-finding inquiry, and that MOVEit Transfer made up less than 4% of its revenue over nine months. One plaintiffs’ lawyer estimated Clop earned $75 million to $100 million from ransoms alone.
Flagstar Bank had just mailed notices to 837,390 people whose Social Security numbers were stolen.
Sources
- MoveIt Transfer flaw leads to wave of data breach disclosures (TechTarget)
- Clop MoveIt Transfer attacks affect over 2,000 organizations (TechTarget)
- Progress Software facing dozens of class action lawsuits, SEC investigation following MOVEit incident (The Record from Recorded Future News)
