MOVEit Transfer mass hack (CVE-2023-34362)

MOVEit Transfer is Progress Software's product for moving large files between organisations. Its web front end had a SQL injection flaw that let attackers, without logging in, reach the database and plant a web shell. Attacks were under way by 27 May 2023, a US holiday weekend, four days before Progress published its advisory and patch on 31 May.

The Cl0p gang did not encrypt anything. It quietly stole files from every MOVEit server it could reach, then named and extorted the victims. Emsisoft's final count was 2,773 organisations and about 95.8 million people, including US state agencies, insurers, pension providers and healthcare companies. Many victims never ran MOVEit themselves: their data sat with a payroll or service provider that did.

Internet-facing file-transfer tools are prime targets because they hold exactly what extortion gangs want. Keep them patched, put them behind access controls, and alert on unusual bulk downloads. And map where your data lives across suppliers, because their breach becomes yours.