The 2023 MOVEit Attacks: A File Transfer Tool and a Mass Data Theft

In late May 2023, a criminal group began exploiting a previously unknown vulnerability in MOVEit Transfer, a file transfer product made by Progress Software. Over the following weeks, victim after victim came forward: airlines, banks, universities, government agencies and payroll providers. The campaign did not encrypt anyone's files. It simply stole data and then demanded money, and it became one of the largest data theft campaigns ever recorded.

What MOVEit does

MOVEit Transfer is software that organisations use to send and receive sensitive files securely, such as payroll data, medical records and financial documents. Because it exists to move valuable information, and because some installations are accessible from the internet so that partners can upload files, it is an attractive target. The files it holds are the sort an extortion group wants.

The vulnerability

The flaw, CVE-2023-34362, was a SQL injection vulnerability in the web application. SQL injection, the same kind of weakness that featured in the LulzSec attacks in 2011, happens when input from a user is treated as part of a database command. By sending crafted requests, the attackers could access the database, and from there install a web shell, a small script that gave them continued access to the server. They then used it to download files.

Progress disclosed the issue on 31 May 2023 and released patches. The security community found evidence that exploitation had started days earlier, around the Memorial Day holiday weekend in the United States, and that the group might have tested the technique earlier. Several further vulnerabilities in the product were found and fixed in the following weeks as researchers examined the code more closely.

Who was behind it

Microsoft and others attributed the campaign to the Cl0p ransomware group, a Russian-speaking criminal gang. In early June, Cl0p published a notice on its leak site telling affected organisations to contact it before a deadline, or have their data published. The same group had used similar tactics before: it exploited a flaw in the Accellion File Transfer Appliance around 2020 and 2021, and in Fortra's GoAnywhere product in early 2023. Targeting file transfer tools had become its pattern.

The scale

Exact numbers depend on who is counting, because many victims were reached indirectly. Security researchers who tracked disclosures later put the number of affected organisations above 2,000 and the number of individuals in the tens of millions. Well-known organisations that disclosed impacts included the BBC, British Airways and the retailer Boots, whose staff data was exposed through a payroll supplier, Zellis, as well as US government bodies and many universities and health organisations. In several cases, a company learned it was affected only because a supplier told them.

Why this model works for criminals

Encrypting systems is noisy, risky and requires a lot of effort per victim. Stealing data from one widely used product gives access to many victims for the price of one exploit. Backups do not defend against it, because the damage is the leak, not the loss of access. The defence has to come earlier, in preventing the break-in and in limiting what is stored.

What defenders did well and badly

• Quick patching helped. Organisations that applied updates and looked for signs of compromise limited the damage.
• Retention hurt. Files that should have been deleted after transfer were still stored on the server.
• Exposure was avoidable. Not every MOVEit server needed to be reachable from the whole internet.

When your supplier is the victim

Many of the organisations affected did not run MOVEit at all. Their data was held by a supplier that did, such as a payroll or benefits provider. That makes the question of what you share with suppliers just as important as how you secure your own systems. Each time you send employee or customer data to a third party, ask what they will do with it, how long they will keep it, and how they will tell you if something goes wrong.

In the European Union, data protection law treats these suppliers as processors working on your behalf. You remain responsible for choosing them carefully, and a written agreement about security and breach notification is expected. It is a sensible habit even where the law does not demand it.

The practical lesson for site owners

Any application you expose to the internet needs a fast update routine, and any data left in it should be cleared as soon as it has served its purpose. Restrict access to admin and upload tools by address where possible, and use a web application firewall to filter malicious requests. Ask your suppliers how they will notify you if they are affected, because your data often sits on their systems too.

If your site accepts uploads or runs a custom application, review it for injection flaws. Our security page lists the protections available, and our CDN page explains the filtering layer you can add in front of your site.