MOVEit Hack: How Cl0p Stole Data From 2,773 Organizations

On Saturday, May 27, 2023, a quiet MOVEit hack began on servers that companies used to swap payroll sheets, health records and student files. Attackers were already pulling data that weekend, according to the CISA and FBI advisory. The software's maker, Progress Software, did not publish its first warning until May 31.

By the time the dust settled, one bug in one file transfer product had touched thousands of organizations that never met the attackers. This case study walks you through it in plain language.

• What MOVEit Transfer is and why a flaw in it spread so far
• A dated timeline, with a note on Pakistan time
• How the attack worked, explained for defenders and students
• Who was blamed, the money involved and what happened next
• Eight lessons you can apply to your own servers and suppliers

What Was the MOVEit Hack?

MOVEit Transfer is a managed file transfer product. Organizations install it so staff, clients and partners can send large or sensitive files through a web portal instead of email. Payroll firms, universities, hospitals and government offices used it heavily.

In late May 2023, criminals found a weakness in that portal before Progress did. The flaw was later tracked as CVE-2023-34362. It let an outsider reach the server's database without logging in. The attackers used it to plant a hidden back door and copy files that users had uploaded.

The group behind the campaign, Cl0p, did not lock up victims' systems the way classic ransomware does. It stole data and then threatened to publish it. That is why many people learned about the MOVEit hack from a breach letter sent months later by a company they had never heard of.

MOVEit Hack Timeline, Day by Day

The dates below are US dates from the cited reports. Pakistan Standard Time is 9 hours ahead of US Eastern daylight time. An evening alert in New York reached Karachi or Abbottabad the next morning.

How Did the MOVEit Transfer Vulnerability Work?

The MOVEit Transfer vulnerability was a SQL injection flaw. A web application talks to its database using SQL queries. If the app mixes user input straight into those queries, a crafted request can change what the database does. Instead of "show this user's files," the database follows instructions the attacker slipped in.

Here is the attack at a conceptual level, based on the Mandiant analysis and the CISA advisory:

1. Find exposed servers. MOVEit's web portal faced the internet by design, so it was easy to locate.
2. Abuse the database flaw. No password was needed to trigger CVE-2023-34362.
3. Plant a web shell. The attackers dropped a small program named to look like a normal MOVEit file. Mandiant calls it LEMURLOOT.
4. Take the files. The web shell could list the database, pull stored files and read cloud storage settings. CISA says it could also create or delete administrator accounts.
5. Extort. Cl0p then contacted victims or listed them on its leak site.

Speed made this campaign different. Mandiant says that in some cases data left the server within minutes of the web shell landing. Rapid7 saw the same file name across many customer networks, which suggests the work was automated rather than hand-crafted for each target.

If you want to understand the bug class itself, read our guide to the OWASP Top 10 2025, where injection still holds a place. Authorized testing with tools such as Burp Suite is how authorized testers find these flaws before criminals do.

Why Did One Bug Reach So Many Organizations?

A managed file transfer server is a collection point. It holds files from many departments, clients and partners in one place. Break into it once and you can take data that belongs to dozens of other companies.

That is what made this a third-party data breach for most victims. Take Zellis, a UK payroll and HR provider. The Register reported that its MOVEit server was exploited and that staff data from British Airways, the BBC and Boots was affected. The BBC said the stolen data included staff ID numbers, dates of birth, home addresses and National Insurance numbers.

None of those three employers ran the vulnerable server. Their supplier did. The same pattern repeated at universities, dental insurers and state agencies. It is the same supply-chain lesson our SolarWinds hack case study covers from a different angle.

How Much Data Was Taken, and What Did It Cost?

Exact totals are hard because some victims still filed notices months later. The most widely cited tally comes from security firm Emsisoft. Its final update on June 28, 2024 counted:

• 2,773 organizations affected
• 95,788,491 individuals affected
• 78.9% of known victim organizations in the US, with Canada next at 13.5%
• Education as the hardest-hit sector at 39.1%, followed by health at 20.1%

Emsisoft lists the largest victims by people affected. Maximus tops it at 11.3 million, then Welltok at 10 million. Delta Dental of California and affiliates had 6.9 million, and the Louisiana Office of Motor Vehicles had 6 million. Emsisoft also notes that some people may be counted more than once.

Emsisoft put a rough cost of about $15.8 billion on the breach by multiplying records by IBM's average cost per record. Treat that as an illustration, as Emsisoft itself says, not a bill anyone paid.

Who Was Behind the MOVEit Hack, and How Sure Is Anyone?

Attribution here is stronger than in many cases, because the criminals claimed it themselves. Three separate signals point the same way:

• Self-claim: Cl0p posted on its leak site on June 6, 2023, taking responsibility, according to Mandiant.
• Microsoft: It linked the thefts to Lace Tempest, the name it uses for the operator behind the Clop extortion site, as reported by The Register.
• Mandiant: It first tracked the activity as UNC4857, then merged it into FIN11 on June 6, citing shared infrastructure, certificates and leak-site activity. Mandiant's post does not state a formal confidence level.

The CISA advisory describes Cl0p ransomware as a group also tracked as TA505, active since February 2019. It notes the group's earlier file transfer campaigns, including GoAnywhere in early 2023.

What remains unconfirmed is any government link. The US State Department's Rewards for Justice program offered up to $10 million for information tying Cl0p to a foreign government, Dark Reading reported. A reward request is a search for evidence, not proof. No public arrests tied to MOVEit appear in the sources cited here.

Did Cl0p Actually Get Paid?

Probably, but by fewer victims than the scale suggests. Ransomware response firm Coveware estimated Cl0p could earn $75 million to $100 million from the campaign, BleepingComputer reported on July 21, 2023. Coveware's CEO said well over 90% of victims did not even negotiate.

So the money came from a small number of very large payments. That matters for defenders. A gang does not need most victims to pay. A handful of big payers can fund the next campaign.

What Happened After the Attack?

Progress kept patching. Rapid7 tracked two more MOVEit flaws in June 2023 and three more disclosed on July 6. For admins, that meant patching again and again in a short window.

The legal fallout landed mostly on Progress and on the companies whose data was stolen. The Record reported that Progress faced about 144 class action lawsuits and formal indemnification letters from 38 customers. Progress said it had spent about $4.2 million on the incident. It expected a $15 million cyber insurance policy to cover much of that.

In August 2024, Progress said the SEC had finished its investigation and did not intend to recommend enforcement action "at this time." That outcome closed one regulatory question but not the private lawsuits.

What Does the MOVEit Hack Mean for Pakistan?

No Pakistani organization appears in the victim figures cited above, and you should not assume one was hit. The lesson for Pakistan is about how work flows, not about this one product.

Many Pakistani software houses, BPO firms and freelancers handle files for US, UK and Canadian clients. Those three countries made up most known MOVEit victims. If you host a file portal, SFTP server or shared drive for a foreign client, you sit in the same position Zellis did. A breach on your side becomes your client's breach. Contracts can pass the cost back to you, as the 38 indemnification letters to Progress show.

Inside Pakistan, banks, hospitals, universities and payroll outsourcers also move sensitive files between partners. Unauthorized access to systems or data can be an offense under the Prevention of Electronic Crimes Act 2016. Still, the law acts after the fact. Prevention sits with whoever runs the server. Our Pakistan bank data breach case study shows how stolen data surfaces later.

Eight Defensive Lessons From the MOVEit Hack

These lessons draw on the CISA mitigations and the patterns in the Mandiant and Rapid7 reports. They suit a small IT team as well as a large one.

1. List every file sharing system you expose. Include old portals, test servers and anything a vendor installed for you.
2. Patch known exploited bugs first. CISA's catalog flagged this flaw on June 2. Keep an emergency patch plan that can run over a weekend.
3. Delete files after delivery. A transfer server is not an archive. Short retention means less to steal.
4. Limit who can reach the portal. Where partners are known, restrict access by network, VPN or allowlist.
5. Watch web folders and admin accounts. New files in the web root and new administrator accounts were both signs in this case.
6. Alert on large outbound transfers. Data left within minutes, so slow weekly log reviews would miss it.
7. Ask suppliers hard questions. Find out which file transfer tools your payroll, HR and IT vendors use, and how fast they patch.
8. Rehearse breach notification. Know who tells clients, staff and regulators, and in what order, before you need to.

If you are an individual who receives a breach letter, expect targeted phishing that quotes your real details. Never use a link or phone number from a message about the breach; contact the company through its official website instead.

How the MOVEit Hack Compares With Other Cases in This Series

Several earlier posts in this series covered direct thefts, such as the Binance hack, where attackers went after one target's own systems. MOVEit is different. The attackers hit a tool, then collected data from everyone who used it. In that sense it sits closer to the Equifax data breach, where one unpatched web application exposed millions of people.

The common thread is simple. Internet-facing software that holds valuable data needs the fastest patching and the closest monitoring you can give it.

Turning MOVEit Into a Lab Exercise at PSTA

Case studies like this one are part of how PSTA teaches defense. The Cyber Security and Ethical Hacking course is a 12-week, beginner-level program, and you need no earlier security background. Classes are available online across Pakistan, and there is also a campus option in Abbottabad.

The course page lists labs on spotting attacks such as SQL injection and phishing. You also run vulnerability scans and set up firewalls and intrusion detection. Then you investigate an incident and document a timeline, and a file transfer breach makes a good scenario for that.

Once you have the basics, the Advanced Ethical Hacking and Penetration Testing course moves into authorized testing with tools such as Burp Suite. To plan your certification path, see cyber security certifications for beginners.

Check One File Server Before Next Week

Pick one system where outsiders upload or download files from your organization. Write down who runs it, what version it is on and how long files stay there. If you cannot answer all three, that is your first task. If you would like guided practice building that habit, PSTA's team can tell you about the next batch.