US Securities and Exchange Commission Probes MOVEit Hack

The zero-day campaign underpinning the May mass attack on Progress Software’s MOVEit file transfer software is now the vulnerability fueling a flotilla of attorneys, the software vendor disclosed in a regulatory filing listing pending litigation and governmental investigations.

See Also: Challenges and Solutions in MSSP-Driven Governance, Risk, and Compliance for Growing Organizations

Among the organizations investigating the May incident is the U.S. Securities and Exchange Commission, the company said.

An independent count of those directly or indirectly affected by the attack, executed by the Clop ransomware group, now tallies more than 2,500 organizations and over 64 million individuals. Among the organizations that recently acknowledged they were caught up in the breach is Sony, which alerted around 6,800 individuals earlier this month (see: Breach Roundup: Still Too Much ICS Exposed on the Internet).

Progress Software says in the regulatory filing that it received on Oct. 2 a subpoena seeking documents related to the incident. “The SEC investigation is a fact-finding inquiry, the investigation does not mean that Progress or anyone else has violated federal securities laws,” the company says. “Progress intends to cooperate fully with the SEC in its investigation.”

Russian-speaking Clop appears to have unleashed a highly automated mass attack on MOVEit instances around May 29, likely timed to take advantage of the U.S. Memorial Day holiday weekend. The group came into possession of a MOVEit zero-day vulnerability, a SQL injection flaw tracked as CVE-2023-34362, possibly as long…