Most MOVEit victims never ran MOVEit

The week

On May 31, 2023, Progress Software disclosed a critical SQL injection vulnerability in its MOVEit Transfer managed file transfer product, later tracked as CVE-2023-34362. Security firms reported that exploitation had begun days earlier, around the US Memorial Day weekend. On June 4 Microsoft attributed the attacks to the actor behind the Clop ransomware and extortion operation. On June 5 the UK payroll provider Zellis said data belonging to some of its clients had been taken through its MOVEit system, and several large British employers confirmed that staff data was exposed. On June 6 Clop posted a notice telling victims to contact it. On June 7 CISA and the FBI issued a joint advisory with indicators of compromise. Progress disclosed further vulnerabilities in the product over the following weeks as researchers examined its code.

Earlier in this series we looked at the GoAnywhere breach and argued that a file-transfer server should be governed like a system of record. MOVEit was the same group using the same method at far greater scale, and it added something new. Many of the organizations whose data was stolen did not run MOVEit at all. Their payroll processors, pension administrators, benefits vendors, research firms and government contractors did. For those clients the usual incident playbook had nothing to offer, because there was nothing to patch. Their exposure turned on three things that had been settled before the attack: how fast they could find out which vendors were affected, who was responsible for notifying whom, and how much data they had sent in the first place.

Finding out which vendors were exposed

Clients learned of their exposure in different ways: a vendor’s notice, a news report, or their own name on Clop’s leak site. A pension system might learn that a benefits verification vendor had been hit. A university might hear from the clearinghouse that handles its enrollment records. An agency might read a contractor’s securities filing. Each source arrived on its own schedule.

Most third-party inventories could not speed this up. They recorded vendor names, contract values and risk tiers, not the products each vendor used to receive the client’s files. The question that mattered in June 2023 was simple and new: which of our vendors runs this product, for which of our data, and what of ours was on it during the exposure window?

Two practical steps make that question answerable within days. The first uses information the organization already has. Its own integration team configures the endpoints that outbound files go to, and file-transfer logs record those hostnames and protocols. Those records often reveal which vendors receive bulk data and sometimes which product sits at the other end. The second is a standing rapid-query process. It needs a list of vendors that receive bulk files, a current security contact for each, and a short question set that can go out within hours of a disclosure. Responses are tracked, and non-responders are escalated through the business owner of the relationship. Contracts can support this with a duty to answer such questions within a set time.

The same question reaches one level further down. A benefits administrator may pass files to an actuarial firm, which runs its own transfer tool. Asking every vendor to list every subcontractor’s products is impractical. Asking it for the few flows that carry the most sensitive data is proportionate.

Who notifies whom

The second issue was the notification chain. When a vendor is breached, several rules assign duties differently. Under HIPAA, a business associate notifies the covered entity, which notifies individuals. State breach laws generally require a service provider to tell the data owner, which notifies residents. The banking agencies’ incident notification rule requires banks to notify their primary regulator of significant incidents within 36 hours. It requires bank service providers to notify their bank customers of certain significant disruptions as soon as possible. Contracts may assign the work differently again.

In practice MOVEit produced confusion. People received letters from companies they had never heard of, or several letters about the same theft from different organizations. Clients learned of their exposure weeks apart from different vendors. Regulators received reports at different stages of understanding.

The fix sits in the contract, and it is more specific than a general breach clause. The vendor should notify the client within a set number of hours of discovering an incident that may involve the client’s data, not after the investigation is complete. The notice should identify the data elements, the populations and the files involved, because those details decide whether the client must notify anyone. The contract should say who notifies individuals and regulators, who approves the wording, and who pays for mailing, call centers and credit monitoring. A short decision matrix agreed in advance avoids negotiating these points while the clock runs.

How much data there was to lose

The size of each client’s breach was set mostly by what it had sent. Many outbound files carried full Social Security numbers where a partial number or an internal identifier would have done. Many sent the entire member or employee population every cycle instead of only changed records. Some vendors kept historical files long after processing them.

Minimization is a design decision about each outbound file. A field-by-field review of each layout, against what the service actually needs, usually finds fields nobody uses. Sending changes instead of full extracts shrinks what sits on a vendor’s server at any moment. Replacing direct identifiers with tokens the vendor cannot reverse limits harm if a file is stolen. A contractual requirement to delete files after processing, with periodic confirmation, keeps the vendor’s copy small.

There are trade-offs. Vendors often ask for more data to improve matching accuracy, and fewer fields can mean more manual exceptions. Those choices belong to the data owner and the business owner together, recorded at contract renewal and whenever a file layout changes. A useful measure is simple: how many outbound bulk flows still carry full Social Security numbers, and how many have had a field review in the past year.

With hindsight

MOVEit became one of the largest data theft campaigns on record. By November 2023, Emsisoft’s running count, drawn from breach notifications, securities filings and the group’s leak site, passed 2,600 organizations and 77 million individuals. Victims included federal and state agencies, pension systems, health plans, universities and financial firms, most exposed through service providers. Class actions against Progress and affected vendors were consolidated in federal court in Massachusetts. Notification rules tightened afterward. The FTC’s amended Safeguards Rule required many non-bank financial institutions to report certain breaches to the agency from May 2024. The SEC’s 2024 Regulation S-P amendments required service providers to notify covered firms within 72 hours. Clop returned to file-transfer products with a campaign against Cleo software in late 2024. Vendor product inventories remain hard to keep current. Minimization has proved the most dependable control, because it limits exposure whichever tool fails next.