MOVEit body count closes in on 400 orgs, 20M+ individuals

July 20, 2023 TH Author

The number of victims and costs tied to the MOVEit file transfer hack continues to climb as the fallout from the massive supply chain attack enters week seven.

In late May, Russian ransomware gang Clop exploited a security hole in Progress Software’s MOVEit product suite to steal documents from vulnerable networks.

As of today, the number of affected organizations is closing is on 400 and include some really big names: the US Department of Energy and other federal agencies as well as huge corporations like energy company Shell, Deutsche Bank, consulting and business services firm PwC, and retail giant TJX Companies, which confirmed to The Register on Wednesday that “some files were downloaded by an unauthorized third party before Progress notified us of the vulnerability.”

TJX owns several retail brands including TJ Maxx, Marshalls, HomeGoods, HomeSense and Sierra.

Despite being one of the compromised companies, the TJX spokesperson added: “We do not believe there was any unauthorized access to any customer or associate personal information on TJX’s systems or any material impact to TJX.”

Plus, it’s looking like Estée Lauder Companies, which owns more than 20 beauty brands and disclosed a “cybersecurity incident” the same day that Clop listed the company on its leak site, may be among the victims too.

As of July 19, 383 organizations and over 20 million individuals have been compromised, according to cybersecurity outfit Emsisoft, which sourced its figures from breach notifications, SEC filings, other public data, and Clop’s leak site.

But, as the infosec team notes, some of the companies whose MOVEit installations were breached provide services to many other organizations.

That one-to-many impact is a very attractive thing for hackers, and that is what makes supply chain threats so sinister

Case in point: Clop exploited a deployment of MOVEit used by payroll services provider Zellis whose customers include British Airways, the BBC, and the Boots pharmacy chain in the UK, among others, and as a result these companies all saw their employees’ records stolen by the Russian gang via the software flaw.

And, as Emsisoft reports, another MOVEit user – the National Student Clearinghouse – partners with more than 3,500 schools in the US and processes information belonging to 17.1 million students.

So it’s likely that the total number of victims will keep growing.

“While this may not be in the same league as the SolarWinds incident, it’s nonetheless one of the most significant hacks of recent years,” Emsisoft Threat Analyst Brett Callow told The Register. “The costs will be absolutely massive, including credit monitoring for millions and lawsuits out the wazoo.”

Progress Software is facing multiple lawsuits claiming poor security led to the MOVEit bug – at least 13, according to The Wall Street Journal.

“To make matters worse, the potential for misuse of the stolen information is significant,” Emsisoft added. “And it’s not only how Cl0p may misuse the information that’s a concern. Once it’s released online, it becomes available to the global community of cyber-miscreants to use in BEC schemes, identity fraud, etc.”

Progress Software declined to comment on how many organizations have been affected by the MOVEit bugs.

“We remain focused on supporting our customers and this report suggests that frequent and transparent updates have been helpful in encouraging customers to rapidly apply the fixes we have released,” a spokesperson told The Register. “We are continuing to work with industry-leading cybersecurity experts to investigate the issue and ensure we take appropriate response measures.”

The spokesperson added: “To our knowledge at this time, none of the vulnerabilities discovered after the May 31 vulnerability have been actively exploited.”

And there have been others since the end of that month.

A very buggy timeline

The May 31 bug – a SQL injection vulnerability – was the first. Progress patched this one, tracked as CVE-2023-34362, the next day. A second bug, CVE-2023-35036, came to light on June 9, and was also patched the next day.

Progress disclosed a third hole, CVE-2023-35708, on June 15.

Finally (we hope), three additional vulnerabilities – CVE-2023-36934, CVE-2023-36932, and CVE-2023-36933 – were spotted and fixed on July 5.

Despite the growing victim count, vulnerable orgs are doing a decent job at remediating MOVEit bugs, according to cybersecurity ratings company Bitsight.

Since the May 31 disclosure, “the number of organizations vulnerable to CVE-2023-34362 has dropped such that at least 77 percent of the originally affected organizations are no longer vulnerable,” Bitsight researcher Noah Stone wrote in a Thursday blog. “At most 23 percent of the initially affected organizations are still vulnerable while higher rates of vulnerability exist among the later CVEs.”

Perhaps unsurprisingly, more organizations are still vulnerable to the three most recent bugs disclosed earlier this month.

“At most 56 percent of organizations originally affected by the newest collection of CVEs … remain vulnerable,” Stone said.

Threat hunters at Huntress discovered the second MOVEit bug, and the firm’s senior security researcher, John Hammond, says these types of supply chain attacks are increasingly attractive to criminals because they provide more bang for the buck.

“Whether or not it be attacks like this MOVEit Transfer example, or even past high-impact intrusions like the Kaseya VSA ransomware incident or SolarWinds exploitation, all of these attacks have a certain supply chain aspect that absolutely expands the potential number of victims, bleeding into downstream organizations and the provider/customer relationship,” Hammond told The Register.

“That one-to-many impact is a very attractive thing for hackers, and that is what makes supply chain threats so sinister.”

However, he added, these types of intrusions mean “threat actors can only play that card once for each attack. After downstream victims are compromised, the well dries up, and the adversaries have to move onto their next attack.” ®