More data stolen in 2023 MOVEit attacks comes to light

After a significant cyber incident that occurred eighteen months ago, where a ransomware gang exploited a zero-day SQL injection vulnerability in Progress Software’s MOVEit Transfer file transfer product, new victims have emerged. One of the latest victims to come to light is tech giant Amazon, which has confirmed that data on over two million of its employees has been leaked.

The vulnerability, known as CVE-2023-34362, was a critical zero-day SQL injection flaw in the MOVEit Transfer tool. Although it was patched at the end of May 2023, the Cl0p/Clop ransomware operation managed to use it to carry out a large-scale breach affecting organizations globally.

Among the victims in the UK were the BBC, Boots, and British Airways, all compromised through the payroll and human resources IT specialist Zellis.

This week, researchers at Hudson Rock revealed details of a major data leak involving at least 25 organizations orchestrated by an actor using the handle Nam3L3ss. This actor posted the data in CSV format on an underground cyber criminal forum.

The leaked data includes employee records from major companies such as HP, HSBC, Lenovo, Omnicom, Urban Outfitters, British Telecom, and McDonalds. The largest amount of data, totaling over 2.8 million records, came from Amazon.

According to Alon Gal from Hudson Rock, the leaked dataset contains contact information, organizational roles, and departmental assignments within Amazon, putting employees at risk of social engineering and targeted phishing attacks.

In a statement to the media, Amazon’s senior PR manager, Adam Montgomery, confirmed the breach, stating that the only information involved was employee work contact information like work email addresses, desk phone numbers, and building locations. Amazon and AWS systems were reported to remain secure without experiencing a security event.

Amazon did not disclose the specific organization through which it was affected.