https://www.theregister.com/2023/07/20/moveit_victim_count/ # # Sign in / up The Register(r) -- Biting the hand that feeds IT # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal Tech (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Sysadmin Month The Reg in Space Emerging Clean Energy Tech Week Spotlight on RSA Energy Efficient Datacenters Vendor Voice Vendor Voice Vendor Voice All Vendor VoiceAmazon Web Services (AWS) Business Transformation DataikuDDNGoogle Cloud for StartupsHewlett Packard Enterprise: AI & ML solutionsIntel vProVMware (X) Resources Resources Whitepapers Webinars & Events Newsletters [cybercrime] Cyber-crime 10 comment bubble on white MOVEit body count closes in on 400 orgs, 20M+ individuals 10 comment bubble on white 'One of the most significant hacks of recent years,' we're told icon Jessica Lyons Hardcastle Thu 20 Jul 2023 // 21:01 UTC # The number of victims and costs tied to the MOVEit file transfer hack continues to climb as the fallout from the massive supply chain attack enters week seven. In late May, Russian ransomware gang Clop exploited a security hole in Progress Software's MOVEit product suite to steal documents from vulnerable networks. As of today, the number of affected organizations is closing is on 400 and include some really big names: the US Department of Energy and other federal agencies as well as huge corporations like energy company Shell, Deutsche Bank, consulting and business services firm PwC, and retail giant TJX Companies, which confirmed to The Register on Wednesday that "some files were downloaded by an unauthorized third party before Progress notified us of the vulnerability." [cybercrime] TJX owns several retail brands including TJ Maxx, Marshalls, HomeGoods, HomeSense and Sierra. [cybercrime] [cybercrime] Despite being one of the compromised companies, the TJX spokesperson added: "We do not believe there was any unauthorized access to any customer or associate personal information on TJX's systems or any material impact to TJX." Plus, it's looking like Estee Lauder Companies, which owns more than 20 beauty brands and disclosed a "cybersecurity incident" the same day that Clop listed the company on its leak site, may be among the victims too. [cybercrime] As of July 19, 383 organizations and over 20 million individuals have been compromised, according to cybersecurity outfit Emsisoft, which sourced its figures from breach notifications, SEC filings, other public data, and Clop's leak site. But, as the infosec team notes, some of the companies whose MOVEit installations were breached provide services to many other organizations. That one-to-many impact is a very attractive thing for hackers, and that is what makes supply chain threats so sinister Case in point: Clop exploited a deployment of MOVEit used by payroll services provider Zellis whose customers include British Airways, the BBC, and the Boots pharmacy chain in the UK, among others, and as a result these companies all saw their employees' records stolen by the Russian gang via the software flaw. And, as Emsisoft reports, another MOVEit user - the National Student Clearinghouse - partners with more than 3,500 schools in the US and processes information belonging to 17.1 million students. So it's likely that the total number of victims will keep growing. [cybercrime] "While this may not be in the same league as the SolarWinds incident, it's nonetheless one of the most significant hacks of recent years," Emsisoft Threat Analyst Brett Callow told The Register. "The costs will be absolutely massive, including credit monitoring for millions and lawsuits out the wazoo." Progress Software is facing multiple lawsuits claiming poor security led to the MOVEit bug - at least 13, according to The Wall Street Journal. "To make matters worse, the potential for misuse of the stolen information is significant," Emsisoft added. "And it's not only how Cl0p may misuse the information that's a concern. Once it's released online, it becomes available to the global community of cyber-miscreants to use in BEC schemes, identity fraud, etc." Progress Software declined to comment on how many organizations have been affected by the MOVEit bugs. * Dublin Airport staff pay data 'compromised' by criminals * Boris Johnson pleads ignorance, which just might work * Third MOVEit bug fixed a day after PoC exploit made public * US government hit by Russia's Clop in MOVEit mass attack "We remain focused on supporting our customers and this report suggests that frequent and transparent updates have been helpful in encouraging customers to rapidly apply the fixes we have released," a spokesperson told The Register. "We are continuing to work with industry-leading cybersecurity experts to investigate the issue and ensure we take appropriate response measures." The spokesperson added: "To our knowledge at this time, none of the vulnerabilities discovered after the May 31 vulnerability have been actively exploited." And there have been others since the end of that month. A very buggy timeline The May 31 bug - a SQL injection vulnerability - was the first. Progress patched this one, tracked as CVE-2023-34362, the next day. A second bug, CVE-2023-35036, came to light on June 9, and was also patched the next day. Progress disclosed a third hole, CVE-2023-35708, on June 15. Finally (we hope), three additional vulnerabilities - CVE-2023-36934, CVE-2023-36932, and CVE-2023-36933 - were spotted and fixed on July 5. Despite the growing victim count, vulnerable orgs are doing a decent job at remediating MOVEit bugs, according to cybersecurity ratings company Bitsight. Since the May 31 disclosure, "the number of organizations vulnerable to CVE-2023-34362 has dropped such that at least 77 percent of the originally affected organizations are no longer vulnerable," Bitsight researcher Noah Stone wrote in a Thursday blog. "At most 23 percent of the initially affected organizations are still vulnerable while higher rates of vulnerability exist among the later CVEs." Perhaps unsurprisingly, more organizations are still vulnerable to the three most recent bugs disclosed earlier this month. "At most 56 percent of organizations originally affected by the newest collection of CVEs ... remain vulnerable," Stone said. Threat hunters at Huntress discovered the second MOVEit bug, and the firm's senior security researcher, John Hammond, says these types of supply chain attacks are increasingly attractive to criminals because they provide more bang for the buck. "Whether or not it be attacks like this MOVEit Transfer example, or even past high-impact intrusions like the Kaseya VSA ransomware incident or SolarWinds exploitation, all of these attacks have a certain supply chain aspect that absolutely expands the potential number of victims, bleeding into downstream organizations and the provider/customer relationship," Hammond told The Register. "That one-to-many impact is a very attractive thing for hackers, and that is what makes supply chain threats so sinister." However, he added, these types of intrusions mean "threat actors can only play that card once for each attack. After downstream victims are compromised, the well dries up, and the adversaries have to move onto their next attack." (r) Get our Tech Resources # Share More about * Cybercrime * Patch * Security More like these x More about * Cybercrime * Patch * Security Narrower topics * 2FA * Advanced persistent threat * Application Delivery Controller * Authentication * BEC * Black Hat * Bug Bounty * Common Vulnerability Scoring System * Cybersecurity * Cybersecurity and Infrastructure Security Agency * Cybersecurity Information Sharing Act * Data Breach * Data Protection * Data Theft * DDoS * Digital certificate * Encryption * Exploit * Firewall * Hacker * Hacking * Identity Theft * Incident response * Infosec * Kenna Security * NCSAM * NCSC * Palo Alto Networks * Password * Patch Tuesday * Phishing * Quantum key distribution * Ransomware * Remote Access Trojan * REvil * RSA Conference * Spamming * Spyware * Surveillance * TLS * Trojan * Trusted Platform Module * Vulnerability * Wannacry * Zero trust More about # Share 10 comment bubble on white COMMENTS More about * Cybercrime * Patch * Security More like these x More about * Cybercrime * Patch * Security Narrower topics * 2FA * Advanced persistent threat * Application Delivery Controller * Authentication * BEC * Black Hat * Bug Bounty * Common Vulnerability Scoring System * Cybersecurity * Cybersecurity and Infrastructure Security Agency * Cybersecurity Information Sharing Act * Data Breach * Data Protection * Data Theft * DDoS * Digital certificate * Encryption * Exploit * Firewall * Hacker * Hacking * Identity Theft * Incident response * Infosec * Kenna Security * NCSAM * NCSC * Palo Alto Networks * Password * Patch Tuesday * Phishing * Quantum key distribution * Ransomware * Remote Access Trojan * REvil * RSA Conference * Spamming * Spyware * Surveillance * TLS * Trojan * Trusted Platform Module * Vulnerability * Wannacry * Zero trust TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like Quick: Manually patch this Zimbra bug that's under attack Smells like Russian cyber spies (again) Patches17 Jul 2023 | 3 Stolen Microsoft key may have opened up a lot more than US govt email inboxes How does the Azure giant come back from this? CSO21 Jul 2023 | 39 JumpCloud says 'nation state' gang hit some customers Updated Enough to make you hopping mad Sysadmin Month18 Jul 2023 | 4 Curbing the cost of cloud analytics and data warehousing On the hunt for price performance gains that Amazon can pass on to its customers Sponsored Feature [cybercrime] Suspected bank-infecting OPERA1ER crime boss cuffed Cops reckon gang swiped as much as $30M from financial orgs Cyber-crime5 Jul 2023 | Microsoft's security roadmap: Protect secrets in Azure DevOps You can't steal what you can't access ... we hope Sysadmin Month16 Jul 2023 | 2 Nickelodeon probes claims of massive data leak as SpongeBob fans rejoice TV network's attorneys 'on a DMCA rampage' ... are you sure you're ready, kids? Cyber-crime6 Jul 2023 | 9 Ex-Amazon manager jailed for stealing $10M using fake vendor invoices Prime doesn't pay - well, not that much, anyway Cyber-crime6 Jul 2023 | 15 RIP Kevin Mitnick: Former most-wanted hacker dies at 59 Obit Tributes paid to husband, father, son and rogue-turned-consultant Security20 Jul 2023 | 52 You've patched right? '340K+ Fortinet firewalls' wide open to critical security bug That's a vulnerability that's under attack, fix available ... cancel those July 4th plans, perhaps? Patches3 Jul 2023 | 13 Ukraine busts bot farm spreading Russian infowar propaganda and fraud Plus: Spanish cops arrest Ukrainian scareware dev after ten-year hunt Security20 Jul 2023 | 14 US adds Euro spyware makers to export naughty list Predator dev joins Pegasus slinger Security18 Jul 2023 | 27 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * T's & C's * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2023 no-js