Risk register · entry
Q3 · EngineeredMOVEit mass-exploit
One file-transfer zero-day breached 2,700+ organisations at once.
Tightly coupled systems where one small fault cascades and takes down the whole machine.
Why this quadrant
An unpatched SQL injection in one file-transfer product is an ordinary flaw. Because 2,500 organisations ran the same product, exploiting it once reached all of them in the same week rather than one company at a time. Roughly 95.8 million people's data was taken. Clop then ran it as an extortion campaign, naming victims on a leak site to set the clock.
The record
- CVE-2023-34362, SQL injection vulnerability, CVSS 9.8certain
- Exploitation began around May 27-28, 2023 (per Mandiant/Rapid7 telemetry)certain
- Progress Software publicly disclosed the vulnerability May 31, 2023certain
- Web shell used: LEMURLOOTcertain
- Roughly 2,500 MOVEit Transfer instances exposed to the public internet as of May 31, 2023certain
- 2,773 organizations affected overalllikely
- Approximately 95.8 million individuals' data exposedlikely
- Clop posted its first batch of 12-13 named victims on its leak site June 14, 2023, threatened public data dumps from June 21certain
- Progress Software: ~$1.5 million direct incident costs in FY2023, $3.7 million insurance recoveries, $8.8 million insurance coverage remainingcertain
- SEC subpoena issued to Progress Software October 2, 2023certain
- Progress Software named in ~118 class-action suits as of early 2024, rising past 140 laterlikely
- Settlements: National Student Clearinghouse $9.95M, Nuance Communications $8.5M, Cadence Bank $5.25M, Arietis Health $2.8Mcertain
- Emsisoft (June 2024) modeled global economic cost at over $15.8 billion using IBM's ~$165-per-record average breach costuncertain
- Zellis (payroll processor) was the third-party conduit exposing BBC, British Airways and Aer Lingus datacertain
Sources
The newsletter
One risk story a week, taken apart the way this one was: what was known, what was ignored, and which quadrant it really belonged to.
No spam, one email a week.