MOVEit Transfer mass exploitation (Cl0p)

In late May 2023, the Russia-speaking extortion crew Cl0p weaponized CVE-2023-34362, a SQL injection zero-day in Progress Software's MOVEit Transfer — managed file-transfer software widely used by banks, governments, payroll providers, and law firms to move sensitive data between organizations.

What happened

Cl0p ran the campaign as a mass-exploitation event rather than targeting individual victims: scanners hammered every exposed MOVEit Transfer instance on the public internet, dropped a webshell ("LEMURLOOT"), and exfiltrated databases. Patches landed on 31 May 2023, but by then most victims had already been breached.

Rather than encrypt data, Cl0p chose pure data extortion: organizations were listed on the group's leak site with deadlines, and those who refused to pay saw chunks of their data published over the following months.

Impact

• 2,700+ organizations confirmed breached, with Emsisoft tracking the long tail through 2024.
• Estimated 95 million individuals had personal information exposed — including U.S. Medicare beneficiaries (via Maximus), UK pension recipients (via Zellis), and German bank customers.
• Notable named victims: BBC, British Airways, Boots, Aer Lingus, Shell, Sony, Deloitte, EY, PwC, the U.S. Department of Energy, Johns Hopkins University, Maximus.
• Estimated aggregate cost: $12+ billion (IBM/Ponemon-derived).

Why it matters

MOVEit illustrates upstream supply-chain risk at its purest: a vulnerability in one product, exploited at internet scale, propagating downstream into thousands of organizations that never directly chose MOVEit but depended on a payroll, accounting, or claims-processing partner that did. The campaign also marked the operational maturity of pure data-extortion as a ransomware alternative — no encryption, no downtime, just leverage.