What was the MOVEit vulnerability?

CVE-2023-34362, a SQL injection flaw in the web application of Progress Software's MOVEit Transfer, a managed file transfer product. It required no authentication. An attacker could reach the underlying database, infer its structure, and execute statements, which they used to escalate to installing a web shell on the server.

Exploitation was observed from around 27 May 2023, over the US Memorial Day weekend. Progress published its advisory on 31 May 2023, CISA added the CVE to the Known Exploited Vulnerabilities catalogue on 2 June, and CISA and the FBI published a joint advisory on 7 June. Two further vulnerabilities in the same product, CVE-2023-35036 and CVE-2023-35708, were disclosed in the weeks that followed.

The web shell deployed after exploitation, initially observed as a file named human2.aspx to blend in with the legitimate human.aspx in MOVEit Transfer. It authenticated requests with a generated password, enumerated files and users in the MOVEit database, and could retrieve the Azure Storage credentials the product used, which enabled bulk exfiltration.

Was data encrypted or held to ransom?

No files were encrypted. This was data theft followed by extortion: the group published victim names on a leak site and demanded payment to avoid publication. That model is harder to recover from than encryption, because functioning backups restore availability and do nothing about a copy of your data sitting in someone else's possession.

Why were so many organisations affected that never used MOVEit?

Because their data was inside somebody else's MOVEit instance. Payroll processors, benefits administrators, pension providers, government contractors and universities used the product to move files containing data about employees, customers, patients and citizens. A single compromised instance at a service provider exposed records belonging to hundreds of downstream organisations.

How many people were affected?

Counts grew for years as organisations completed their own notifications, and published trackers eventually recorded thousands of organisations and tens of millions of individuals. Any specific figure is a snapshot: it depends on when it was compiled and on which downstream notifications had been filed by then, so a number without a date should not be repeated.

The MOVEit Breach: One File Transfer Product, Thousands of Victims

Most large breaches involve one organisation losing its own data. MOVEit is the case where thousands of organisations lost data they had entrusted to somebody else, through a product most of the affected people had never heard of.

The vulnerability itself is unremarkable: a SQL injection in a web application, requiring no authentication. What made it one of the largest data theft events on record is where that web application sat. Managed file transfer products exist to move sensitive files between organisations, which means they concentrate exactly the data worth stealing, they must be reachable from the internet to do their job, and they hold credentials for the storage behind them.

One bug in one product, and the consequences propagated outward through every organisation that had ever sent files through an affected instance.

Facts here come from the joint CISA and FBI advisory, Progress Software's own advisory, and the NVD entry.

Timeline

Date	Event
Around 27 May 2023	Exploitation observed, over the US Memorial Day weekend
31 May 2023	Progress Software publishes an advisory and patches
2 June 2023	CISA adds CVE-2023-34362 to the Known Exploited Vulnerabilities catalogue
7 June 2023	CISA and the FBI publish joint advisory AA23-158A
June 2023	The group begins naming victims on its leak site. Two further MOVEit vulnerabilities are disclosed
2023 to 2025	Downstream notifications continue as organisations identify whose data was in affected instances

The holiday weekend timing is a pattern rather than a coincidence: it maximises the gap before anyone notices, and this operator has used it repeatedly.

The mechanism

Step one: SQL injection, unauthenticated. The MOVEit Transfer web application contained a SQL injection flaw reachable without logging in. Depending on the database engine behind it, an attacker could infer the structure and contents of the database and execute statements against it.

Step two: escalate to code execution. Database access was used to create a privileged application session and to write to the server, which is the step that turns a data-layer flaw into control of the host.

Step three: install the web shell. The payload, tracked as LEMURLOOT, was first seen as human2.aspx, named to sit alongside the product's legitimate human.aspx. It generated a random password and required it in a request header, so casual scanning of the endpoint returned nothing interesting.

Step four: take the storage credentials. The web shell could enumerate files, folders and users in the MOVEit database, and retrieve the Azure Storage credentials the product itself used. That is the detail that made mass exfiltration efficient: rather than pulling files one at a time through the application, the attackers could use the product's own credentials against the storage behind it.

Step five: exfiltrate, then extort. Files were taken. Nothing was encrypted. Victim names appeared on a leak site with a deadline, and payment was demanded to prevent publication.

SQL Injection Explained covers the underlying class, and the sequence here is a good demonstration that SQL injection is rarely just about reading a table.

Why the blast radius was that large

Three properties compounded.

The product concentrates sensitive data. Managed file transfer exists precisely to move payroll files, medical records, claims data, student records and benefits information between organisations. A compromised instance is not a compromised web server; it is an archive of everything routed through it.

It has to be internet-facing. External partners must reach it. That is the function.

It holds credentials to the storage behind it. Compromising the application yields the keys to the repository, which is a much larger prize than the application itself.

Add the fourth-party effect and the numbers explain themselves. A pension administrator runs MOVEit and serves 400 employers. A payroll processor runs it and serves thousands of businesses. A government contractor runs it on behalf of an agency. The people whose data was taken had no relationship with Progress Software, no way to know the product existed, and no ability to influence whether it was patched.

Extortion without encryption

This is the strategic shift worth internalising, and it changes the defensive calculus.

Encryption-based ransomware attacks availability. The counter is recovery: immutable backups, tested restores, and the discipline in 3-2-1 Backup Strategy. An organisation that can restore can refuse to pay.

Theft-based extortion attacks confidentiality, and there is no equivalent counter. Your systems are running, your data is intact, and a copy is in somebody else's hands. Paying buys a promise to delete, from people whose business model is built on holding data hostage. Not paying means publication.

The controls that actually reduce this exposure sit upstream of the incident:

Hold less data, and delete it on schedule. Data that was purged when it stopped being needed cannot be stolen from a file transfer product two years later.
Encrypt files before they enter a transfer system, so the product moves ciphertext it cannot read. This is the single most effective control for this exact scenario and it is rarely implemented, because it breaks the convenience the product was bought for.
Minimise what goes into transfers. Fields nobody needs downstream should not be in the file.
Retention on the transfer platform itself. Files that should have been deleted after delivery were still sitting in instances months later.

What Is DLP covers monitoring where data goes, and the deeper point is that the exposure was created before the vulnerability existed, by decisions about what data was collected and how long it was kept.

The product category is the pattern

This operator had already run the same play. Managed file transfer products have been targeted repeatedly, with the same shape each time: a pre-authentication flaw in an internet-facing appliance holding concentrated data, exploited at scale over a holiday period, followed by mass extortion.

That makes the category predictable, which is useful. If you run a managed file transfer product, or a VPN appliance, or an email security gateway, or any other internet-facing appliance that concentrates data or access, you are running something in a class that is systematically hunted for pre-auth vulnerabilities.

Practical consequences:

Treat appliance patching as an emergency process, measured in hours after a vendor advisory rather than in the next maintenance window.
Subscribe to the vendor's security advisories directly rather than waiting for the news.
Reduce exposure where you can. IP allowlisting for partner access, a reverse proxy with authentication in front, or moving the service off the public internet entirely.
Watch for the file-system artefacts. New .aspx files in web directories, unexpected child processes from the web application, and outbound transfers to unfamiliar destinations are the detections that fire here, and they are covered generally in Threat Hunting Guide.
Segment the appliance, so compromising it does not also yield the internal network, per Network Segmentation Guide.

The notification problem

For organisations that never ran the product, the incident arrived as a phone call from a supplier saying data about their employees or customers had been taken.

That creates obligations regardless of who ran the software. Breach notification duties follow the data and the relationship with the individual, not the ownership of the server. Organisations spent months answering questions they could not answer without help: which of our records were in that instance, whose data was in them, and when.

The preparation that pays off here is knowing where your data goes. A supplier inventory that records which third parties hold what data, and a contractual requirement that they notify you promptly, turns an unanswerable question into a lookup. What to Do After a Data Breach covers the response from the individual's side.

What generalises

Internet-facing appliances that concentrate data are a target class. Patch them on a different clock from everything else.
Your exposure includes your suppliers' software, and their suppliers' software, and you will not be consulted about any of it.
Data theft extortion has no recovery lever. The mitigations are data minimisation, retention and encrypting before transfer.
A vendor's own storage credentials inside a compromised product are usually the real prize, which is an argument for scoping those credentials tightly.
Numbers move for years. Any victim or record count is a snapshot with a date on it.