The MOVEit breach hit 2,500 organizations — because one file transfer tool had a zero-day

In May 2023, the Cl0p ransomware gang exploited a zero-day vulnerability in MOVEit Transfer, a managed file transfer software made by Progress Software. The vulnerability allowed the attackers to gain unauthorized access to MOVEit servers used by organizations worldwide.

The breach was massive in scope: over 2,500 organizations were affected, including government agencies, universities, healthcare providers and major corporations. Over 90 million people's personal data was compromised. The attack was a 'supply chain' breach: rather than hacking individual organizations, the attackers compromised the software they all used.

The MOVEit breach was the largest cyberattack of 2023 and one of the most consequential supply chain attacks in history, alongside SolarWinds. The case illustrated how a single vulnerability in a widely used infrastructure tool can compromise thousands of organizations simultaneously, and how the attack surface of the modern enterprise extends far beyond its own network to every vendor and tool it uses.