In 2023 the Cl0p ransomware group exploited a zero-day and extortion in the MOVEit file transfer tool to steal data from thousands of organisations at once, then extorted them by threatening to publish it on a dark web leak site. It showed how one flaw in a widely used tool can become a supply-chain event affecting millions of people.
The MOVEit campaign became one of the largest data theft operations ever linked to a single software vulnerability. Unlike traditional ransomware attacks that encrypted systems, the attackers focused on stealing sensitive data before demanding payment to prevent its public release.
The campaign highlighted how organisations can become victims even when their own security controls are effective. Many affected businesses did not develop or manage the vulnerable software themselves. Instead, they relied on a trusted third-party file transfer platform used to exchange sensitive information.
The incident demonstrated that a single flaw in widely deployed software can rapidly become a supply chain event affecting thousands of organisations and millions of individuals.
What Happened in the Extortion and When
In late May 2023, attackers began exploiting a previously unknown vulnerability in Progress MOVEit Transfer, a managed file transfer solution used by organisations worldwide to securely exchange sensitive files.
The vulnerability, tracked as CVE-2023-34362, allowed unauthenticated attackers to execute code remotely against vulnerable internet-facing MOVEit servers. Progress Software released security updates on 31 May 2023, while the US Cybersecurity and Infrastructure Security Agency (CISA) quickly issued alerts urging organisations to patch affected systems immediately.
Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a | https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
The campaign was attributed to the Cl0p ransomware group, although unlike many previous Cl0p operations, this campaign focused primarily on mass data theft and extortion rather than ransomware deployment.
Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Attackers systematically scanned the internet for exposed MOVEit servers before exploiting vulnerable systems and extracting stored files.
The Steal and Extortion Model
The MOVEit campaign marked a shift in how many financially motivated attackers operated.
Instead of encrypting systems and disrupting business operations, Cl0p focused on stealing sensitive information first.
The process generally followed this pattern:
- Exploit the MOVEit vulnerability.
- Gain access to stored files.
- Exfiltrate sensitive data.
- Contact victims demanding payment.
- Threaten to publish stolen information if payment was refused.
This approach avoided many of the challenges associated with deploying ransomware.
Organisations often remained operational, but they faced significant pressure because confidential information had already left their environment.
For victims, the concern shifted from restoring systems to managing the consequences of large-scale data exposure.
Why a Single File Transfer Tool Created a Supply Chain Event
Managed file transfer platforms occupy an important role within many organisations.
They commonly store and exchange:
- Customer records
- Employee information
- Financial documents
- Healthcare information
- Legal files
- Government records
Many organisations also use third-party service providers that rely on MOVEit to process client information.
As a result, one compromised MOVEit server often contained data belonging to multiple organisations.
This created a cascading effect.
An organisation might never have installed MOVEit directly yet still become affected because one of its suppliers, payroll providers, healthcare partners, insurers, or managed service providers used the platform.
The incident became an example of third-party cyber risk extending well beyond the organisation that originally deployed the software.
The Scale of the Extortion
The scale of the MOVEit campaign was unprecedented for a single software vulnerability.
According to public reporting and ongoing tracking by cybersecurity researchers, thousands of organisations worldwide were affected, with the stolen information ultimately impacting millions of individuals across government agencies, healthcare providers, universities, financial institutions, retailers, and technology companies.
Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a | https://www.emsisoft.com/en/blog/44123/moveit-data-breach/
Victims included organisations across North America, Europe, and Asia-Pacific.
Because many organisations processed information on behalf of customers or business partners, downstream impacts often extended far beyond the original breach.
One vulnerable application frequently exposed data belonging to numerous unrelated organisations.
This demonstrated how software supply chain incidents can create widespread consequences even when attackers compromise only a relatively small number of systems.
How Leak Sites Are Used to Pressure Victims in Extortion
Unlike traditional ransomware groups that rely primarily on encrypted systems, Cl0p increased pressure by publicly naming organisations that refused to negotiate.
The group maintained a leak site hosted on the Tor network where stolen information or victim names could be published.
Announcements and updates about victims were also promoted through criminal communities operating across Telegram, helping increase visibility within the cybercriminal ecosystem.
It is important to recognise that criminal activity is not confined to one platform. Threat intelligence teams monitor activity across Tor, Telegram and I2P, together with relevant underground forums and marketplaces, because different actors use different channels.
Publishing victim names creates additional pressure by increasing legal, regulatory, and reputational risks before any stolen information is released.
The possibility of public disclosure often becomes a significant factor during incident response.
The Lesson: Third-Party Exposure, Extortion, and Monitoring for Leaked Data
The MOVEit campaign reinforced several important lessons.
Understand Third-Party Risk
Organisations should maintain visibility over suppliers, software providers, and service partners that process sensitive information.
Third-party risk assessments should extend beyond contractual requirements and include ongoing security reviews.
Patch Critical Systems Quickly
Internet-facing applications should receive security updates as soon as practical after vendors release patches for actively exploited vulnerabilities.
Monitor for Leaked Data
Even after a breach has occurred, organisations benefit from understanding whether stolen information appears within criminal communities.
DarkThreatX supports this through dark web monitoring for business and enterprise dark web monitoring.
The platform continuously monitors 100B+ records across criminal intelligence sources, including activity across Tor, Telegram and I2P, together with underground forums and marketplaces.
DarkThreatX also:
- Monitors 24/7
- Indexes more than 1 million new stealer logs every week
- Delivers alerts in under five minutes
- Reports zero false positives
Early notification helps organisations investigate exposed information, assess downstream risk, and respond before stolen data becomes more widely distributed.
Prepare Incident Response Plans
Large-scale third-party incidents often require coordination across legal, security, communications, executive leadership, regulators, customers, and suppliers.
Planning these processes before an incident significantly improves response times.
Conclusion
The 2023 MOVEit campaign demonstrated that attackers no longer need to encrypt systems to create significant business pressure.
By exploiting one widely deployed file transfer platform, Cl0p stole sensitive information from thousands of organisations before demanding payment to prevent public disclosure.
The incident reinforced the importance of rapid patch management, third-party risk management, and continuous monitoring for leaked data.
As organisations increasingly rely on cloud services and external software providers, understanding where sensitive information resides and monitoring for its exposure remain essential parts of modern cyber defence.
Frequently Asked Questions
What was the MOVEit breach?
The MOVEit breach was a large-scale 2023 data theft campaign in which the Cl0p group exploited a zero-day vulnerability in the MOVEit Transfer file transfer platform. Rather than deploying ransomware, the attackers stole sensitive information from vulnerable systems and used it for extortion.
How did Cl0p extort victims?
After stealing sensitive data, Cl0p demanded payment in exchange for not publishing the information. Victims who did not engage risked having their names or stolen data published on the group’s leak site hosted on Tor, increasing reputational and regulatory pressure.
Why did MOVEit affect so many organisations?
MOVEit was widely used by businesses, governments, healthcare providers, and third-party service providers to transfer sensitive files. Because many organisations shared data through the same platform, one exploited vulnerability created downstream impacts affecting thousands of organisations and millions of individuals.
What is the lesson from MOVEit?
Organisations should patch internet-facing software promptly, understand third-party technology risks, and continuously monitor for leaked data and exposed information. Early visibility helps reduce response times and limits the long-term impact of supply chain breaches.
