Cl0p's MOVEit attack tally surpasses 2,000 victim organizations
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-34362 | Unauthenticated SQL Injection in Progress MOVEit Transfer CVE-2023-34362 is an unauthenticated SQL injection flaw (CWE-89) in Progress MOVEit Transfer that allows an attacker with no credentials to gain unauthorized access to the product's database. It is triggered remotely via crafted input submitted to the MOVEit Transfer web application, with the impact varying by the backend database engine in use (MySQL, Microsoft SQL Server, or Azure SQL). A successful attacker can infer the structure and contents of the database and, depending on the engine, execute SQL statements that alter or delete database elements, exposing data handled by the file-transfer service. Any organization running an internet-reachable MOVEit Transfer instance is affected; public internet-exposure scans around disclosure identified on the order of a few thousand servers, each typically serving enterprise or government user bases. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2023-06-02 with known ransomware use and an EPSS exploitation probability of 99.9% (100th percentile), while no public PoC is known. Do: Apply the vendor's updates immediately, per Progress instructions and CISA's required action. Until patched, restrict internet exposure of MOVEit Transfer and check the backend database for unexpected structure or content changes and deletions. Because in-the-wild exploitation and ransomware use are confirmed, treat any unpatched, internet-facing instance as potentially compromised and review stored transfer data and access logs for anomalies. | 9.8 | 100% | KEV ransomware PoC |
| large≈2,000-3,000 internet-exposed MOVEit Transfer servers (public internet-exposure scans) |
Full article455 words · extracted from helpnetsecurity.com · click to collapse
The number of victim organizations hit by Cl0p via vulnerable MOVEit installations has surpassed 2,000, and the number of affected individuals is now over 60 million.
The victim organizations are overwhelmingly based in the US. “The most heavily impacted sectors are finance and professional services and education, which account for 13.8 percent and 51.1 percent of incidents respectively,” Emsisoft researchers have shared on Monday.
IT market research company KonBriefing Research shows similar numbers, and links to data breach notification alerts by many of the companies.
Latest victims
Among the latest victims is the Better Outcomes Registry & Network (BORN), an Ontario-based perinatal, newborn and child registry, which in late May published a breach notice about the cybersecurity incident linked to the MOVEit vulnerability, and notified the authorities, including the Ontario Provincial Police and the Information and Privacy Commissioner (IPC) of Ontario.
“An in-depth analysis revealed that the files copied during the breach contained personal health information of approximately 3.4 million people – mostly those seeking pregnancy care and newborns who were born in Ontario between January 2010 and May 2023,” the institution recently stated.
The company said that threat actors may have stolen data such as name, address, postal code, date of birth, health card number (with no version code), but not banking or financial information.
The provincial government of the Canadian province of Nova Scotia had to send more than 165,000 notification letters to people who’s sensitive personal data (social insurance numbers, banking information) was stolen as a result of the breach.
The Oregon Department of Transportation confirmed in their breach notice that personal information of approximately 3.5 million Oregonians has been accessed.
As we reported on Monday, the US educational non-profit organization National Student Clearinghouse was also hit and, consequently, data belonging to nearly 900 schools and their students has been compromised.
MOVEit hack victim number still rising
Cl0p has been naming MOVEit hack victims on their leak site for months.
The ransomware/cyber extortion gang exploited an SQL injection vulnerability (CVE-2023-34362) in the popular MOVEit file transfer solution to compromise thousands of exposed installations and access the underlying databases.
Since the platform is used many government and financial institutions as well as private and public organizations, it is hard to tell how many of them have been impacted in total.
“Some of the organizations impacted provide services to multiple other organizations, and so the numbers (…) are likely to increase significantly as those organizations start to file notifications,” said Emsisoft’s Zach Simas.
“It should be noted that there will invariably be some overlap in terms of individuals impacted. Some organizations had MOVEit exposure via multiple vendors, which means the customers of those organizations will likely have had multiple exposures too.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/09/26/moveit-victim-number/