MOVEit Transfer Breach (2023)

MOVEit Transfer is a managed file-transfer (MFT) product made by Progress Software. Organizations use it to move sensitive files between internal systems, business partners, payroll providers, benefits administrators, and government agencies. It is the kind of product nobody talks about until it fails: a quiet piece of plumbing that handles regulated data, often with privileged access into HR, finance, and operations systems on both ends of the transfer.

By 2023, MOVEit Transfer was widely deployed across banks, insurers, healthcare networks, public-sector agencies, universities, and the managed service providers (MSPs) that operate file transfer on behalf of smaller customers. That last group matters: many of the organizations later named in the breach were not Progress customers at all. Their data was moved through a third-party benefits or payroll vendor that ran MOVEit on their behalf. To the affected people, that distinction did not exist.

Progress Software is a US-based, publicly traded vendor. MOVEit Transfer ships as on-premise and cloud-hosted variants, with a web interface for administrators and end users and a database (typically Microsoft SQL Server or Azure SQL) behind it. That web interface is the part Cl0p went after.

Based on publicly reported analysis from Mandiant, Microsoft, CISA, and Progress Software itself, the timeline runs roughly as follows.

Before the breach. The Cl0p ransomware group had a history of targeting managed file-transfer products. In December 2020 they exploited Accellion FTA. In early 2023 they exploited Fortra's GoAnywhere MFT. MOVEit was the third MFT product in a consistent pattern: find a single web-exposed file-transfer appliance widely deployed in regulated industries, develop a zero-day, mass-exploit it before patches exist.

Initial exploitation. According to Mandiant's public reporting, Cl0p began exploiting MOVEit Transfer instances no later than 27 May 2023, during the US Memorial Day long weekend. The choice of timing matters: weekend exploitation windows give attackers more hours inside customer systems before on-call teams notice.

Discovery and disclosure. On 31 May 2023, Progress Software published an advisory disclosing CVE-2023-34362, a critical SQL injection vulnerability in the MOVEit Transfer web application, and released emergency patches. CISA issued its own alert and added the CVE to the Known Exploited Vulnerabilities catalog within days. Two additional MOVEit vulnerabilities were disclosed in the weeks that followed as Progress and external researchers continued reviewing the codebase.

Cl0p claims responsibility. On 4 June 2023, Cl0p publicly claimed the campaign on its leak site and began naming victims who had not paid. Unlike a traditional ransomware operation, no files were encrypted in the customer environments. Cl0p relied entirely on data theft and the threat of publication.

Customer impact wave. Over the following months, disclosure notices appeared across the US, UK, EU, and beyond. By late 2023 and into 2024, public trackers maintained by Emsisoft and others put the affected organizations at more than 2,700 and the individuals notified at over 90 million. Notable named victims included the US Department of Energy, several US state agencies, British Airways, the BBC, Boots, Shell, large pension and retirement administrators, and major healthcare and education systems.

Regulatory and legal consequences. The US Securities and Exchange Commission opened an investigation into Progress Software. Class-action lawsuits were filed in the United States. Regulators in the UK and EU opened parallel reviews. Progress disclosed material costs related to the incident in subsequent SEC filings.

In plain English: the MOVEit Transfer web application trusted user input from an unauthenticated endpoint in a way that let attackers speak directly to the underlying database. Once they could speak to the database, they could create their own administrative session, list every file moved through the system, and pull those files out.

More technically, CVE-2023-34362 is a SQL injection vulnerability in the MOVEit Transfer web interface. Public research from Mandiant, Huntress, and Rapid7 describes an attack chain along the following lines:

• Attackers reached a web endpoint that did not properly authenticate the request and did not safely parameterize user-supplied input.
• They used SQL injection to write a malicious web shell, publicly tracked as LEMURLOOT (also referred to as human2.aspx), into the MOVEit web folder.
• The web shell exposed an authenticated-looking endpoint that let the attacker enumerate MOVEit accounts, list files and folders, retrieve files from the underlying storage, and create new privileged sessions.
• From there, Cl0p performed bulk download of stored files. Because MOVEit retained files post-transfer in many configurations, the theft included files that had been moved days, weeks, or months earlier.

The technical control failures that mattered most:

• The vulnerable endpoint was reachable from the public internet by design, because MOVEit is, by design, an internet-exposed file transfer interface.
• File retention policies kept large volumes of sensitive files accessible long after the business reason for the transfer had passed.
• Logging and detection were not tuned to flag bulk file enumeration and bulk download from a single session, which is exactly what the web shell did.
• Many customer instances were operated by MSPs and SaaS providers, so the downstream organizations had no direct telemetry into what was happening to their data.

No exploit code is provided here. The defensive lesson is more useful than the offensive one.

MOVEit was not just a software vulnerability. It was a textbook third-party risk management failure across an entire industry.

• Vendor criticality was underestimated. MOVEt was often treated as utility infrastructure rather than a high-criticality data processor. The product moved regulated data on behalf of HR, payroll, and benefits functions, but it rarely showed up in the top tier of vendor inventories.
• Data concentration was invisible. Few customers could answer, in the first 48 hours, the only question that mattered: "How many files of ours, containing what, are sitting inside this product right now?" The data was theirs. The visibility was not.
• Fourth-party exposure was unmapped. Many of the largest named victims did not run MOVEit themselves. Their benefits administrator did. Or their payroll provider did. Or a government agency that processed their employees' data did. The breach surfaced fourth-party dependencies that had never been documented.
• Questionnaires did not reveal real exposure. SOC 2 reports and security questionnaires for these MFT vendors looked acceptable. None of them captured the actual operational risk: a single web-exposed product retaining large volumes of sensitive files.
• Contract clauses did not translate into controls.Most contracts required notification of incidents. Very few required exposure mapping in advance, retention minimization, or evidence that the vendor could tell customers which specific files were taken.
• Vendor monitoring was too slow. The exploitation window opened on a Saturday. The first widespread customer awareness arrived on Wednesday. For data exfiltration at machine speed, that delta is the entire breach.
• Customer notification was reactive. Because affected organizations did not know in advance what data sat inside MOVEit, individual disclosure letters trickled out over months, eroding trust each time.

The MOVEit campaign's business impact has to be read in two layers: impact on Progress Software, and impact on the much larger downstream ecosystem.

For Progress Software: SEC filings disclosed material costs related to the incident, including legal expenses, investigation costs, and insurance recoveries. The company became the subject of an SEC investigation and multiple class-action lawsuits. Brand trust in MOVEit Transfer as a product took a measurable hit.

For the downstream ecosystem: Based on tracking by Emsisoft, KonBriefing, and other public researchers, more than 2,700 organizations confirmed exposure. Estimates of affected individuals exceeded 90 million globally by 2024. Specific consequences included:

• Mass customer notification programs at pension administrators, healthcare networks, universities, and government agencies.
• Years of credit monitoring and identity protection commitments paid for by affected organizations.
• Regulatory inquiries in the US, UK, and EU.
• Class-action lawsuits filed against both Progress and dozens of downstream organizations.
• Board-level scrutiny of vendor concentration and file-transfer architecture across critical industries.
• Industry-wide reassessment of managed file-transfer products as a category, including alternatives evaluated, retention policies tightened, and SaaS instances pulled behind private connectivity.

The MOVEit campaign reshaped how regulators, boards, and TPRM teams think about file transfer and vendor concentration.

• CISA elevated managed file transfer to an explicit area of concern and reissued guidance on attack-surface reduction.
• The SEC opened a formal investigation of Progress Software and continued to push public companies on cyber incident disclosure expectations.
• UK and EU data protection regulators opened reviews into named data controllers and processors involved in the campaign.
• Class-action consolidation in US federal court drove multi-year litigation costs for downstream organizations.
• Several industries, including state government and public-sector pension administration, formally re-tendered file-transfer services with much stricter vendor security requirements.
• The broader category of managed file-transfer products received sustained security research scrutiny, leading to additional CVE disclosures and patches across multiple vendors throughout 2023 and 2024.

Some consequences are confirmed and measurable. Others, such as the long-term reputational hit to MOVEit as a brand or the eventual settlement values, will keep unfolding through 2026 and beyond.

1. Do not classify file-transfer vendors as low risk because the contract value is small. Classify them by the data that flows through them.
2. Treat any internet-exposed managed file-transfer product as a high-risk data processor by default, regardless of the brand.
3. Require vendors to tell you, in advance, exactly what files of yours they retain and for how long. "We follow your retention policy" is not an answer.
4. Map the fourth parties that handle your data through your benefits, payroll, claims, and HR vendors. The MOVEit victims who fared best already had that map before 31 May 2023.
5. Make zero-day playbooks for your top critical vendors. The first 72 hours after a vendor-side CVE are decisive.
6. Require notification SLAs measured in hours, not days, and rehearse them with your critical vendors in writing.
7. Aggressively reduce retention inside vendor-hosted file-transfer and SaaS systems. Files that no longer exist cannot be stolen.
8. Demand that critical vendors log bulk enumeration and bulk download events, and demand the ability to receive those logs.
9. Stop relying on SOC 2 alone for assurance on data-handling vendors. Ask the operational questions SOC 2 does not.
10. Build a public-statement template before the next vendor breach, not during it.

Most breach summaries reduce MOVEit to "a SQL injection bug got patched." That is technically true and operationally useless.

The deeper lesson is that the MOVEit campaign was a data concentration event before it was a vulnerability event. The attackers did not need to compromise thousands of companies. They needed to compromise one product that already held sensitive files from thousands of companies. The breach was decided years earlier, when each of those organizations chose to keep transferred files inside the vendor longer than they had to, without ever asking what the worst case looked like.

The second thing most people miss is that the slowest part of the incident was not detection. It was attribution at the customer level. Organizations could see, within days, that MOVEit had been exploited. They could not answer, for weeks, which of their own files had been taken. That gap, between "the vendor was breached" and "this is exactly what we lost", is where customer trust was actually spent.

The third thing people miss is the fourth-party layer. Most of the largest victim populations were users of a benefits administrator, a payroll provider, or a government agency that itself used MOVEit. None of those users had ever signed a contract with Progress Software. The breach traveled three relationships deep, and arrived intact.

A third-party breach does not start on the day the attacker gets in. It starts months earlier, when a business gives trust, access, data, and operational dependency to a vendor without continuously proving that trust is still safe. MOVEit was the bill for years of unmapped retention, unexamined fourth parties, and questionnaires that measured paperwork instead of exposure. The vendors moved the files. The customers still owned the consequences.