MOVEit Breach 2023: How One Zero-Day Hit 1,000+ Organizations and Cl0p Made $100M

The MOVEit Transfer mass exploitation in May–June 2023 is the largest single vulnerability exploitation event in documented history by number of affected organizations. The Clop ransomware group exploited a SQL injection zero-day in Progress Software's MOVEit Transfer file sharing platform, compromising over 1,000 organizations and exposing data belonging to tens of millions of individuals in a single coordinated campaign. The victims ranged from Shell and British Airways to the US Department of Energy and the personal data of 101,000 Oregon DMV customers.

MOVEit represents a paradigm shift in ransomware economics: rather than compromising organizations individually, Clop identified a single vulnerability in widely-deployed managed file transfer software and simultaneously exploited every internet-accessible instance in the world. The economics of mass exploitation — one vulnerability, thousands of victims, thousands of potential ransom demands — are fundamentally more efficient than targeted attack campaigns.

What Happened

Clop ransomware group identified CVE-2023-34362 in Progress Software's MOVEit Transfer platform prior to public disclosure and weaponized it for a coordinated mass exploitation campaign. Beginning in late May 2023, Clop systematically scanned the internet for MOVEit Transfer instances and exploited the SQL injection vulnerability to extract data from each. The scale of the automated exploitation was extraordinary — Clop compromised over 1,000 organizations in a campaign that lasted days, not months. The affected organizations spanned every sector: government agencies, financial services firms, healthcare organizations, energy companies, technology companies, and professional services firms. Clop's business model for MOVEit differed from traditional ransomware: rather than encrypting data and demanding ransom for decryption keys, they focused on data exfiltration and extortion — threatening to publish sensitive data on their leak site unless organizations paid. Many organizations chose not to pay, and Clop published data from non-paying victims. The scale of simultaneous victims overwhelmed Clop's own extortion capacity — they could not negotiate with 1,000+ organizations simultaneously, and many victims did not engage with the extortion demand at all.

The Attack Vector: A Zero-Day in File Transfer Infrastructure

The vulnerability exploited — CVE-2023-34362 — was a SQL injection flaw in MOVEit Transfer's web interface. SQL injection is a category of vulnerability that has existed for over two decades and is prevented through standard secure coding practices. Progress Software's implementation of the MOVEit web interface contained an injectable SQL query that allowed unauthenticated attackers to extract data from the MOVEit database and, in some configurations, achieve remote code execution.

Clop had identified and weaponized this vulnerability before disclosure, exploiting it in a coordinated campaign that began in late May 2023. The attackers automated the exploitation to scan for and compromise internet-facing MOVEit Transfer instances at scale, extracting data from each. Because MOVEit is specifically designed for enterprise file transfer, the data stored in compromised instances was disproportionately sensitive: financial reports, HR records, healthcare data, government documents, and intellectual property transferred through the platform by organizations that used it as a secure file sharing solution.

Private Equity Implications

The MOVEit breach has a specific PE dimension: due diligence targets that use managed file transfer software for sharing sensitive financial, legal, or HR documents — and that have not assessed whether their file transfer platforms are current and properly secured — may have experienced undisclosed data exposure. Post-acquisition security assessments of companies that used MOVEit Transfer during the 2023 exploitation window should include investigation of whether those instances were compromised and what data may have been exfiltrated. PE firms that use managed file transfer platforms for sharing deal documents, financial models, and portfolio company data should evaluate whether those platforms were affected by the MOVEit campaign and whether equivalent vulnerabilities exist in their current platforms.