United States
USA
MOVEit Transfer zero-day mass data theft campaign
Beginning in late May 2023, CL0P mass‑exploited a zero‑day SQL injection flaw (CVE‑2023‑34362) in PROGRESS SOFTWARE’s MOVEit Transfer to install web shells and steal data at scale. Advisories documented extensive third‑party exposure, with breaches at service providers cascading to downstream customers (e.g., ZELLIS to BBC, BOOTS, BRITISH AIRWAYS). Emsisoft tracked thousands of affected organizations and tens of millions of impacted individuals. CISA and NCSC urged entities to take MOVEit systems offline and patch.
82
Estimated severity
82 / 100
93
Source reliability
93 / 100
Approximate Date
2023-05-31
Targeted Company
PROGRESS SOFTWARE
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
BBC (Sub-tier supplier)BOOTS (Sub-tier supplier)BRITISH AIRWAYS (Sub-tier supplier)MAXIMUS (Software vendor)MILLIMAN (Software vendor)PBI RESEARCH SERVICES (Software vendor)ZELLIS (Software vendor)
Geographic Impact
Country Targeted Company
Other Affected Countries
Canada
CAN
United Kingdom
GBR
Target country
United States
Affected countries
CanadaUnited KingdomUnited States
Impacted regions
Europe · United KingdomNorth America(canUsa)
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Downstream customer disruptionService unavailabilitySupply chain data integrity impact
Affected sectors
Education & ResearchFinance & InsuranceGovernment & Public AdministrationHealthcare & Public HealthHospitality & TravelProfessional & Business ServicesRetail
Affected departments
No information
Attack Profile
Attack types
Data breachData exfiltrationMalwareSQL injectionZero-day exploitation
Attributed threat actors
CL0P
Sources
Incident Sources
cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158ancsc.gov.ukhttps://www.ncsc.gov.uk/information/moveit-vulnerabilityemsisoft.comhttps://www.emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysiscybersecuritydive.comhttps://www.cybersecuritydive.com/news/progress-software-moveit-meltdown/703659resecurity.comhttps://www.resecurity.com/blog/article/cl0p-ups-the-ante-with-massive-moveit-transfer-supply-chain-exploitcloudskope.comhttps://www.cloudskope.com/breaches/moveit-breach-2023fsapartners.ed.govhttps://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2023-06-16/alert-critical-vulnerability-moveit-transfer-software