MOVEit: 3 years on from the zero-day that exposed 93 million records

Sun, 31 May 2026 09:00:00 -0300

Three years ago, on this exact day, Progress Software published an emergency alert for MOVEit Transfer customers: there was a critical SQL injection vulnerability being actively exploited. What nobody knew yet was the scale of the damage. When the dust settled, more than 2,700 organisations — the BBC, British Airways, the US Department of Energy, American and Canadian state governments — had been compromised. Around 93 million people had data stolen. And the group behind it all had started operating four days before public disclosure.

Moveit on Locodigital

MOVEit: 3 years on from the zero-day that exposed 93 million records