What was the MOVEit breach?

The MOVEit breach was a 2023 mass-exploitation campaign in which the Cl0p (TA505) extortion group abused a zero-day SQL-injection flaw (CVE-2023-34362) in Progress MOVEit Transfer to deploy the LEMURLOOT web shell and steal data from hundreds of organisations, then extort them without deploying ransomware. It is one of the largest third-party data-theft events on record and fits Cl0p's pattern of targeting managed-file-transfer products. Defences include minimising MFT exposure, emergency patching, third-party inventory and purging data at rest.

The MOVEit Mass Hack: How Cl0p Turned One Flaw Into a Global Data Heist

In late May 2023 the Cl0p (CL0P / TA505) extortion crew mass-exploited a zero-day SQL-injection flaw in Progress Software’s MOVEit Transfer, a widely deployed managed-file-transfer (MFT) product. Rather than deploy ransomware, Cl0p dropped a web shell, enumerated the MOVEit database and bulk-exfiltrated stored files, then extorted victims by threatening to publish data. Because MOVEit sits at the data-exchange chokepoint of banks, payroll processors, universities and government agencies, a single product flaw cascaded into one of the largest third-party data-theft events on record.

The Flaw

CVE-2023-34362 is an unauthenticated SQL-injection vulnerability in the MOVEit Transfer web application enabling database access and web-shell deployment; it was added to CISA’s Known Exploited Vulnerabilities catalogue on 2 June 2023. Two further flaws followed in June 2023 (CVE-2023-35036 and CVE-2023-35708), though of the three only CVE-2023-34362 is listed in CISA’s KEV catalogue. The web shell deployed is tracked as LEMURLOOT. T1190 T1505.003

Timeline

27–28 May 2023: earliest confirmed exploitation and exfiltration indicators (Rapid7, Mandiant).
31 May 2023: Progress publishes its advisory; 1–2 June: CISA advisory, CVE assigned and KEV-listed.
Mid-June 2023 onward: Cl0p begins naming victims on its leak site, running the extortion for months.

Attribution & Model

CISA/FBI (advisory AA23-158A) and vendors attribute the campaign to Cl0p/TA505, which publicly claimed it. The model is pure data-theft extortion — no encryption — and fits Cl0p’s recurring pattern of hitting managed-file-transfer products: Accellion FTA, Fortra GoAnywhere (CVE-2023-0669), MOVEit, and later Cleo (CVE-2024-50623). T1567 T1657

Scale (attributed, dated floors)

By 10 August 2023, KonBriefing counted at least 637 affected organisations and Emsisoft estimated at least ~41 million individuals from notices issued so far — explicitly a floor. Later tallies grew substantially (commonly cited figures of 2,700+ organisations and 90M+ individuals); treat specific totals as reported, and verify against current sources.

Defensive Lessons

Treat internet-facing MFT appliances as high-value, pre-auth-reachable targets: minimise exposure, put them behind a WAF or VPN, and patch on an emergency SLA tied to CISA KEV.
Inventory third parties that hold your data in MFT platforms — your exposure includes your vendors’ instances.
Minimise data at rest in transfer systems (purge after delivery); MFT is a conduit, not a store.
Hunt for web shells (unexpected .aspx artifacts) and anomalous database queries, and monitor egress volume; encrypt stored data so exfiltrated files are less usable.

Protect File-Transfer and Third-Party Data

Mjolnir Security helps organisations secure managed-file-transfer platforms and manage third-party data risk.

Attack Surface ManagementThird-Party RiskManaged Detection & ResponseIncident ResponseThreat Hunting

Attack Surface Management Finding exposed MFT appliances and prioritising KEV patching.
Third-Party Risk Advisory Mapping where vendors hold your data in transfer platforms.
24/7 Incident Response Containment when mass data theft is suspected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 12, 2026