United States
USA
MOVEit Transfer zero-day mass data theft campaign
Beginning in late May 2023, CL0P mass‑exploited a zero‑day SQL injection flaw (CVE‑2023‑34362) in PROGRESS SOFTWARE’s MOVEit Transfer to install web shells and steal data at scale. Advisories documented extensive third‑party exposure, with breaches at service providers cascading to downstream customers (e.g., ZELLIS to BBC, BOOTS, BRITISH AIRWAYS). Emsisoft tracked thousands of affected organizations and tens of millions of impacted individuals. CISA and NCSC urged entities to take MOVEit systems offline and patch.
82
Estimated severity
82 / 100
93
Source reliability
93 / 100
Approximate Date
31/05/2023
Targeted Company
PROGRESS SOFTWARE
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
ZELLIS (Software vendor)BBC (Sub-tier supplier)BOOTS (Sub-tier supplier)BRITISH AIRWAYS (Sub-tier supplier)PBI RESEARCH SERVICES (Software vendor)MAXIMUS (Software vendor)MILLIMAN (Software vendor)
Geographic Impact
Country Targeted Company
Other Affected Countries
United Kingdom
GBR
Canada
CAN
Target country
United States
Affected countries
United StatesUnited KingdomCanada
Impacted regions
North America · United StatesNorth America · CanadaEurope · United Kingdom
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Supply chain data integrity impactService unavailabilityDownstream customer disruption
Affected sectors
Government & Public AdministrationFinance & InsuranceHealthcare & Public HealthEducation & ResearchHospitality & TravelRetailProfessional & Business Services
Affected departments
No information
Attack Profile
Attack types
Zero-day exploitationSQL injectionData exfiltrationData breachMalware
Attributed threat actors
CL0P
Sources
Incident Sources
cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158ancsc.gov.ukhttps://www.ncsc.gov.uk/information/moveit-vulnerabilityemsisoft.comhttps://www.emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysiscybersecuritydive.comhttps://www.cybersecuritydive.com/news/progress-software-moveit-meltdown/703659resecurity.comhttps://www.resecurity.com/blog/article/cl0p-ups-the-ante-with-massive-moveit-transfer-supply-chain-exploitcloudskope.comhttps://www.cloudskope.com/breaches/moveit-breach-2023fsapartners.ed.govhttps://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2023-06-16/alert-critical-vulnerability-moveit-transfer-software