Anatomy of a Breach: MOVEit Transfer — Cl0p's Mass Exploitation Campaign That Hit 2,500 Organisations

2,500 organisations. 60 million people. Through a file transfer tool. SQL injection. In 2023.

In late May 2023, the Cl0p ransomware group began mass-exploiting CVE-2023-34362 — a critical SQL injection vulnerability in MOVEit Transfer, a managed file transfer (MFT) application developed by Progress Software. MOVEit Transfer is used by thousands of organisations — including government agencies, financial institutions, healthcare providers, and enterprises — to exchange sensitive files securely. Cl0p had identified and begun exploiting the vulnerability before it was publicly disclosed, deploying web shells on vulnerable servers and systematically exfiltrating data.

The scale was staggering: over 2,500 organisations and more than 60 million individuals were affected worldwide. Victims included Shell, Ernst & Young, PwC, the US Department of Energy, the Oregon and Louisiana Departments of Motor Vehicles, multiple US government agencies, and — critically for the UK — the BBC, British Airways, Boots, and Ofcom. Cl0p did not encrypt files (as traditional ransomware does) but instead exfiltrated data and demanded payment to prevent publication — a pure extortion model. The campaign was the most impactful mass exploitation event since SolarWinds/Sunburst (2020).

SQL injection. In a file transfer tool. In 2023. Still.

The MOVEit vulnerability was SQL injection — the same vulnerability class that has appeared in virtually every year of this series since Heartland Payment Systems (2008). From Heartland through TalkTalk (2015), VTech (2015), and now MOVEit (2023) — SQL injection has been the most persistent, most exploitable, and most preventable vulnerability class in the history of cybersecurity. Fifteen years later, it remains capable of compromising 2,500 organisations simultaneously.

SQL injection. Fifteen years. 2,500 organisations. Test your applications.

The MOVEit breach is the single most powerful argument for continuous web application testing in the history of cybersecurity. SQL injection — a vulnerability class that has been documented, understood, and preventable for over twenty years — compromised 2,500 organisations and exposed 60 million people in 2023. Web application penetration testing finds SQL injection. Vulnerability scanning identifies unpatched MOVEit and other MFT platforms. Cyber Essentials mandates 14-day patching. SOC in a Box detects exploitation and data exfiltration. And UK Cyber Defence provides incident response when file transfer platforms are compromised.

Related Articles