MOVEit: one file transfer tool, thousands of victims

About this series

A quiet breach with a massive reach

In late May 2023, a cybercriminal group known as Cl0p began exploiting a previously unknown flaw in a popular file transfer tool called Progress MOVEit Transfer. This tool is used by organizations to move large amounts of data securely between systems. Because the tool was trusted and widely used, the impact was immediate and enormous.

The flaw, tracked as CVE-2023-34362, allowed attackers to break into MOVEit servers and steal the data stored within them. By the time the vulnerability was disclosed in mid-2023, the attackers had already spent days or weeks pulling files from thousands of organizations. The victims included government agencies, schools, hospitals, and major corporations.

For many small and mid-sized businesses, the shock was not that they used MOVEit themselves, but that their partners did. Payroll providers, benefits administrators, and billing services often used the tool to handle client data. When those vendors were hit, the data of their small business clients was exposed as well.

Why the exploit worked

The vulnerability was a SQL injection flaw. This is a common type of weakness where an attacker sends a specific command to a database that the software then executes. In this case, it gave the Cl0p group full access to the files sitting on the MOVEit server. They did not need a password to get in.

The Cl0p group is a sophisticated Ransomware (show definition) organization. However, in this campaign, they changed their usual approach. Instead of using software to lock up files and demand a payment to restore them, they focused entirely on data theft. They took the files and then told the victims to pay or see their sensitive information posted on a public website.

The vendor chain problem

One of the biggest lessons from MOVEit is that your security is only as strong as the vendors you trust. Many businesses found out their data was stolen only when they received a notification from a third-party service provider. In some cases, organizations did not even realize that a specific vendor was using MOVEit to handle their files.

This highlights the importance of vendor visibility. You need to know which companies have your data, what they are doing with it, and what tools they use to protect it. If a vendor handles your payroll, they have the social security numbers and bank details of every employee. If that vendor uses an insecure tool to move those files, your employees are at risk.

Extortion without encryption

Historically, businesses thought they were safe from ransomware if they had good backups. The logic was simple: if an attacker locks your files, you just restore from a backup and keep working. The MOVEit incident proved that backups are not enough to stop extortion.

Because the attackers stole the data rather than locking it, the business still had access to its files. However, the threat was the public release of that data. For a business, this means potential lawsuits, regulatory fines, and a massive loss of trust from customers and employees. This shift in tactics makes prevention and vendor monitoring even more critical than they were five years ago.

Lessons for your business today

While the MOVEit breach happened in 2023, the lessons apply to the security landscape of 2026. Every business uses cloud services and third-party tools. You cannot avoid these vendors, but you can manage the risk they bring into your organization.

• Maintain a list of all vendors that have access to your sensitive data.
• Ask your vendors about their breach notification process before you sign a contract.
• Practice data minimization: do not give a vendor more data than they absolutely need to do their job.
• Ensure your own systems are patched (show definition) regularly to close known holes.

Action plan for third-party risk

• Create an inventory of every vendor that holds employee or customer data
• Verify that key vendors (payroll, IT, legal) use Multi-factor authentication (MFA) (show definition) for their own access
• Review contracts to ensure vendors must notify you of a breach within 48 hours
• Delete sensitive data from vendor portals once it is no longer needed
• Assign one person to monitor for security alerts regarding the tools you use