United Kingdom
GBR
MOVEit exploit at ZELLIS triggers downstream breaches at BRITISH AIRWAYS and BBC
On 05/06/2023, payroll provider Zellis was compromised via the MOVEit Transfer zero‑day (CVE‑2023‑34362), leading to theft of employee data and extortion by CLOP. Multiple Zellis customers, including British Airways, BBC, Boots and Aer Lingus, confirmed staff data exposure, evidencing significant third‑party supply‑chain impact.
55
Estimated severity
55 / 100
87
Source reliability
87 / 100
Approximate Date
05/06/2023
Targeted Company
ZELLIS
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
BRITISH AIRWAYS (Business process outsourcer)BBC (Business process outsourcer)BOOTS (Business process outsourcer)AER LINGUS (Business process outsourcer)
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
United Kingdom
Affected countries
United Kingdom
Impacted regions
United Kingdom · United Kingdom
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Supply chain coordination disruptionOperational disruption
Affected sectors
Professional & Business ServicesTransportationMedia & EntertainmentRetail
Affected departments
Information TechnologyHuman ResourcesLegal, Risk & Compliance
Attack Profile
Attack types
Exploitation of vulnerabilityZero-day exploitationData exfiltrationThird-party or partner compromiseExtortion
Attributed threat actors
CLOP
Sources
Incident Sources
therecord.mediahttps://therecord.media/bbc-british-airways-hit-by-zellis-zero-daycisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158ainformationweek.comhttps://www.informationweek.com/cyber-resilience/payroll-provider-zellis-falls-prey-to-moveit-transfer-breachphoenix.securityhttps://phoenix.security/movit-transfer-vulnleighday.co.ukhttps://www.leighday.co.uk/our-services/group-claims/moveit-zellis-data-breach-claimthestack.technologyhttps://www.thestack.technology/zellis-data-breachiisf.iehttps://www.iisf.ie/MOVEit-Transfer-global-data-breach-affects-Ireland