The MOVEit Breach

Background

MOVEit Transfer is a managed file-transfer (MFT) application developed by Ipswitch, Inc. and owned since 2008 by Progress Software Corporation. It is used by corporations, universities, healthcare providers, and government agencies to securely exchange files, and by 2023 it was deployed by thousands of organizations worldwide, including many that used it indirectly through payroll processors, benefits administrators, and other third-party vendors.

Discovery of the Vulnerability

On May 31, 2023, Progress Software disclosed a critical SQL injection vulnerability in MOVEit Transfer and MOVEit Cloud, later designated CVE-2023-34362, with a CVSS severity score of 9.8 out of 10. The flaw allowed an unauthenticated attacker to access the MOVEit Transfer database and, depending on the database engine used, infer information about its structure and contents or execute SQL statements that could alter or delete data. Security researchers and Progress Software later determined that exploitation of the vulnerability had already been underway since at least May 27, 2023, days before the public disclosure, meaning it had been used as a true zero-day.

The Cl0p Extortion Campaign

The attacks were attributed to Cl0p (also written Clop), a Russian-speaking cybercriminal group that emerged around 2019 as an offshoot of the CryptoMix ransomware family and that the U.S. Cybersecurity and Infrastructure Security Agency has described as an influential force in criminal malware distribution. Rather than encrypting victim systems, Cl0p used the MOVEit flaw purely to exfiltrate data at scale, a technique it had refined in earlier mass-exploitation campaigns against Accellion's File Transfer Appliance in 2020 and Fortra's GoAnywhere MFT product in early 2023. On June 7, 2023, Cl0p publicly claimed responsibility for the MOVEit attacks and began posting threats on its dark-web leak site, giving victim organizations a deadline of June 14, 2023, to make contact or negotiate a ransom before their stolen data would be published.

Scope and Notable Victims

Two additional related vulnerabilities in MOVEit Transfer, CVE-2023-35036 and CVE-2023-35708, were disclosed and patched in the weeks following the initial advisory, further widening the pool of at-risk deployments. Analyses compiled by security researchers tallied thousands of organizations, over 2,700 in some counts, and tens of millions of affected individuals, with figures exceeding 95 million people at various points as new disclosures accumulated. High-profile victims whose data was exposed, in many cases through third-party payroll or benefits vendors rather than direct use of MOVEit, included the BBC, British Airways, Shell, Estee Lauder, the U.S. Department of Energy, and numerous American state government agencies, universities, and healthcare organizations such as Maximus and Delta Dental of California.

Response and Aftermath

Progress Software released patches for each disclosed vulnerability and worked with CISA and the FBI, which issued joint advisories describing the vulnerability and indicators of compromise. Affected organizations faced a wave of breach notifications, regulatory scrutiny, and class-action lawsuits in the United States. Cl0p's extortion campaign was estimated by some security researchers to have generated tens of millions of dollars in ransom payments. The incident intensified scrutiny of managed file-transfer software as a high-value target and pushed many organizations and regulators to reassess third-party and supply-chain data-handling risk.

Significance

The MOVEit breach is regarded as one of the largest mass-exploitation data-theft campaigns to date, notable less for its technical sophistication than for the scale achieved by combining a single zero-day vulnerability with the widespread, often invisible, use of one vendor's software across countless downstream organizations. It is frequently cited alongside the Accellion and GoAnywhere incidents as evidence of a broader shift by ransomware-affiliated groups toward extortion-only campaigns that exploit file-transfer infrastructure rather than deploying encryption payloads.

Timeline

• 2023-05-27Exploitation of the MOVEit Transfer SQL injection flaw begins, later confirmed to predate public disclosure.
• 2023-05-31Progress Software discloses the critical vulnerability, later designated CVE-2023-34362, and issues a security advisory and patch.
• 2023-06-07The Cl0p extortion group publicly claims responsibility for exploiting the flaw and begins contacting victims via its dark-web leak site.
• 2023-06-09A second related vulnerability, CVE-2023-35036, is disclosed and patched.
• 2023-06-15A third related vulnerability, CVE-2023-35708, is disclosed and patched.
• 2023-06-16CISA and the FBI issue a joint cybersecurity advisory on Cl0p's exploitation of MOVEit Transfer.
• 2023-2024Breach notifications continue for months as downstream vendors and their clients discover and disclose data exposure, ultimately implicating thousands of organizations and tens of millions of individuals.