How the MOVEit hack happened: one file-transfer flaw, 60 million people

The 2023 MOVEit attacks hit more than 1,000 organizations and more than 60 million people, and the gang behind them did not lock a single file. They copied what was sitting on file-transfer servers and threatened to publish it.^[1][2] This case file covers how one flaw in a widely used file-sharing product became one of the largest data thefts on record, what it cost, and the control that would have left the thieves far less to take.

What happened

How they got in

The flaw let an outsider send specially crafted requests to a MOVEit server over the internet and trick it into running the attacker's commands, with no password needed.^[1][3] The attackers then planted a hidden web page, disguised to look like part of the normal software, that worked as a back door. Through it they could read the server's database, list the files stored there and download them.^[1][3]

Because the flaw was unknown until the attacks began, patching could not have stopped the first wave. What decided the damage was what each server held. Files that had been sent months earlier and never cleared out were just as easy to steal as the day's transfers.^[3] The attackers did not need to encrypt anything to get paid. Federal agencies noted that since 2021 this group had leaned mostly on stealing data rather than locking it.^[1]

What it cost

By August 25, 2023, a count of disclosures showed about 60 million people affected.^[2] The largest single victims included the government contractor Maximus with about 11 million people, France's unemployment agency with about 10 million, and Louisiana's Office of Motor Vehicles with about 6 million.^[2] Colorado's Medicaid agency and Oregon's Department of Transportation each reported millions more.^[2]

One incident response firm estimated Clop could earn about $100 million from ransom payments. One analysis, based on an average cost per breached record, put the total cost of the breaches at close to $10 billion.^[2] The US State Department offered a reward of up to $10 million for information on Clop.^[2] The group is known for extortion that threatens to publish stolen data, and US agencies estimate it has hit thousands of organizations worldwide since 2019.^[1]

The missing control

The missing control: purging data from file-transfer servers. A file-transfer system is a loading dock, not a warehouse. Files should be deleted automatically once the recipient has picked them up, or after a short set period.

No organization could have patched a flaw that no one knew about. But every organization decided how long files sat on its MOVEit server. Where files were cleared within days, the attackers found little to take. Where years of payroll, benefits and customer files were kept, they found everything.^[2][3] Short retention does not stop the break-in; it limits what a break-in is worth. Keeping internet-facing servers patched and watched is the other half of the job, and the government advisory stressed both.^[1]

What to do in your business

• Set automatic deletion on file-sharing tools. In whatever you use to send files, whether a transfer service, shared links or a client portal, set files to expire after a few days and remove old uploads now.
• List who holds your data. Ask payroll, benefits, accounting and IT vendors what file-transfer tools they use and how long they keep your files. The MOVEit victims included many companies hit through a vendor.
• Patch internet-facing systems first. Anything reachable from the internet, such as file transfer, VPN, remote access and websites, should get security updates within days, not at the next quarterly cycle.
• Send only what is needed. Before sharing a spreadsheet, strip columns the recipient does not need, such as Social Security numbers or dates of birth.
• Watch for large downloads. Ask your IT provider to alert on unusual volumes of data leaving file servers, especially at night or on holiday weekends.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.