MOVEit: 3 years on from the zero-day that exposed 93 million records

Three years ago, on this exact day, Progress Software published an emergency alert for MOVEit Transfer customers: there was a critical SQL injection vulnerability being actively exploited. What nobody knew yet was the scale of the damage. When the dust settled, more than 2,700 organisations — the BBC, British Airways, the US Department of Energy, American and Canadian state governments — had been compromised. Around 93 million people had data stolen. And the group behind it all had started operating four days before public disclosure.

What MOVEit Transfer was and why it was everywhere

MOVEit Transfer, developed by Ipswitch and later acquired by Progress Software, is a managed file transfer (MFT) product. Companies use this kind of tool to move sensitive files between internal systems, partners and customers in a traceable, auditable way: payroll, benefits data, medical records, tax documents.

The problem with MFTs is exactly that: they sit in the middle of everything. An HR company using MOVEit to process payroll for 50 clients means a single compromised server gives access to those 50 companies' data at once. That's the logic of a supply chain attack: you don't attack the final victim directly — you attack the supplier that serves all of them.

For more context on how supply chain attacks work in practice, see what happened with JDownloader compromised via a Python repository and with the VS Code extension that became an attack vector on GitHub.

How the attack worked technically

CVE-2023-34362 is a SQL injection flaw in MOVEit Transfer's HTTP/S request handlers. The entry point was the /human.aspx endpoint: the application didn't properly sanitise user input before assembling its SQL queries, so an attacker could inject arbitrary commands straight into the database.

The Cl0p group exploited this to install a custom webshell called LEMURLOOT, a C# file disguised as human2.aspx — a name deliberately similar to the legitimate human.aspx file in the web interface. LEMURLOOT authenticated via a specific HTTP header (X-siLock-Comment): without the correct password, the webshell returned a generic 404, making it invisible to anyone who didn't know exactly where to look.

Once installed, LEMURLOOT could:

• List and download every file stored in MOVEit
• Extract Azure Blob Storage credentials and settings (where many customers stored files in the cloud)
• Create, modify and delete users in the system
• Return the data gzip-compressed to make detection via traffic inspection harder

Mandiant confirmed that the first exploits took place on 27 May 2023 — four days before public disclosure by Progress Software. Cl0p had already compromised dozens of organisations before any patch was available.

Who Cl0p are and why they're different from other ransomware groups

Cl0p (also referenced as CL0P, TA505 and Lace Tempest by Microsoft) operates differently from conventional groups: they don't encrypt systems — they steal data and threaten to publish it. That makes them particularly efficient at supply chain attacks via MFTs, because they don't need deep access to the internal network, only to exfiltrate the files already sitting on the transfer server.

Before MOVEit, Cl0p had used the same strategy with Accellion FTA in 2021 and with GoAnywhere MFT in February 2023. The pattern repeated: find a zero-day in a popular MFT, exploit it quietly for days or weeks, then announce and extort the victims all at once.

The scale of the damage: who was affected

The impact cut across entire sectors. According to CISA, more than 3,000 US entities and 8,000 globally were affected. Among the confirmed victims:

• BBC, British Airways, Boots and Aer Lingus — via the compromise of payroll company Zellis
• US Department of Energy and other American federal agencies
• Government of Nova Scotia (Canada) — an estimated 100,000 employees affected
• Banks, insurers, hospitals and universities across the US, Europe and Oceania

The worst-hit sectors, according to a survey by Emsisoft: education (39.1%), healthcare (20.1%) and finance and professional services (13.3%). In total, the personal data of approximately 93.3 million individuals was exposed — a figure that puts MOVEit among the largest breaches in history in terms of the variety of organisations affected, even if other cases are bigger in raw record volume, such as the Canvas LMS breach by ShinyHunters with 275 million records.

The lesson three years haven't erased

The MOVEit case demonstrated at industrial scale something the security industry knew in theory: a supply chain is only as secure as its weakest link. A flaw in a piece of infrastructure software used by third parties multiplies across all of those third parties' customers, without the final victim having any control over — or even knowledge of — the exposure, until the extortion email arrives.

If you manage infrastructure or assess third-party risk, MOVEit is the case that justifies asking suppliers hard questions: which MFT do you use? How often do you apply critical patches? Where are the access logs and who monitors them?

For incident response teams, the historical comparison is instructive: ILOVEYOU infected 45 million PCs in hours — noisy, immediate, easy to detect. MOVEit was the opposite: silent, surgical, and for many organisations the first sign that something had gone wrong was the attacker getting in touch to collect.

If you've been through an incident involving MFTs or supply chain attacks at your organisation, tell us in the comments — real cases help a lot of people who are building defences today.