MOVEit Bug Tied To Breach Of Up To 11M Records Via Govt Contractor

July 28, 2023 TH Author headline,government,data loss,flaw

The number of organizations hit by the MOVEit file transfer application bug now includes government contractor Maximus. Impacted in the attack are up to 11 million Maximus customers.

In a July 26 filing with the Securities and Exchange Commission, the company said it anticipates to inform at least 8 million to 11 million individuals that their personal information may have been compromised. Maximus provides health and human services programs to state and local governments.

Progress Software, makers of the MOVEit software, disclosed there was a critical zero-day vulnerability in the application that allowed unauthorized third parties to access its customers’ MOVEit environments on May 31.

A growing number of organizations around the world have confirmed since that disclosure to say they, too, have fallen victim to the vulnerability that appears to have been exploited by the Cl0p ransomware group.

Instead of deploying ransomware, however, cybersecurity researchers say Cl0p has changed tactics to steal the data of millions of people worldwide and then demand payment to not release the data.

“It’s sort of a new business model for them,” Huntress senior researcher John Hammond told SC Media in June. Huntress researchers helped find the zero-day exploit Cl0p used to trick MOVEit’s database to execute the gang’s commands.

The MOVEit hack was already on track to become the most widespread file transfer hack even before the SEC disclosure by Maximus, which claimed in the filing that it believes that the incident did not move beyond the MOVEit environment and did not disrupt its business operations.

Maximus uses the application for internal and external file-sharing purposes, including “to share data with government customers pertaining to individuals who participate in various government programs.” The company said it has already begun to notify customers, as well as federal and state regulators.

The company also disclosed that it plans to spend about $15 million for the quarter ended June 30 on the total investigation and remediation activities related to the cybersecurity incident.