MOVEit: one flaw, thousands of organizations

The story

MOVEit is software for transferring large files securely, used by governments, banks, health care providers and many other organizations. It often sits on a server reachable from the internet so outside partners can send and receive files.

On May 27, 2023, a criminal group called Cl0p began using a previously unknown flaw in MOVEit. The flaw let it get into the database behind the software and take the files stored there. The maker released a fix on May 31, but by then data had already been stolen from many organizations.

The final count was more than 2,700 organizations and the personal data of about 93 million people. Many of those people had never heard of MOVEit. Their data was taken because a company they dealt with, or a company that company used, had a MOVEit server.

Why it mattered

MOVEit showed how far one flaw in widely used software can reach. Many of the people affected had never heard of it; their data was taken because a company they dealt with, or one of that company’s suppliers, used it. Every service that holds a business’s files is part of its security, including the ones it does not run itself.

The lesson today

Your data does not only live on your own systems. Payroll providers, benefits administrators, accountants and other vendors hold it too, and their tools can be the weak point. Knowing which vendors hold what, and asking how they protect it, is part of protecting your business.