US SEC launches probe into mass MOVEit breach

The US Securities and Exchange Commission (SEC) has launched a probe into the mass breach of Progress Software’s MOVEit file switch device, which is now estimated to have affected over 2,000 organisations and uncovered the private knowledge of round 64 million individuals.

Conducted by ransomware operation Clop (or Cl0p) in late-May 2023, the breach concerned the exploitation of a zero-day structured question language injection vulnerability within the device, which allowed the prison enterprise to exfiltrate huge quantities of knowledge from a wide range of organisations with out deploying a ransomware locker.

While Progress Software subsequently patched three separate vulnerabilities within the weeks following the incident (CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708), Clop’s smash-and-grab exfiltration ways meant it was in a position to steal a big quantity of knowledge earlier than the patches befell, and use the specter of releasing that knowledge to extort funds from the victims.

In a regulatory filing, Progress Software stated it had obtained a subpoena from the SEC on 2 October “seeking various documents and information relating to the MOVEit Vulnerability”, including that the regulator’s inquiry at this stage is proscribed to fact-finding.

“The investigation does not mean that Progress or anyone else has violated federal securities laws, and the investigation does not mean that the SEC has a negative opinion of any person, entity or security,” it wrote. “Progress intends to cooperate fully with the SEC in its investigation.”

According to research by safety provider Emsisoft, the present variety of organisations impacted by the incident reached 2,547 as of 12 October, whereas the variety of individuals affected has reached 64,467,518.

Progress Software confirmed in its submitting it’s now going through dozens of authorized battles on account of the breach, together with 23 formal letters from prospects, an unspecified variety of that are looking for indemnification; an insurer serving a subrogation discover looking for restoration for all bills incurred in reference to the vulnerability; and 58 class motion lawsuits filed by people who declare to have been impacted by the information exfiltration.

In phrases of bills already incurred, the submitting added that the MOVEit vulnerability has value the corporate round $1m up to now, though it additional added that the complete value shouldn’t be but recognized on account of the entire ongoing authorized issues and investigations.

“With respect to the litigation, the proceedings remain in the early stages, alleged damages have not been specified, there is uncertainty as to the likelihood of a class or classes being certified or the ultimate size of any class if certified, and there are significant factual and legal issues to be resolved,” it stated.

“Also, each of the governmental inquiries and investigations mentioned above could result in adverse judgements, settlements, fines, penalties or other resolutions, the amount, scope and timing of which could be material, but which we are currently unable to predict. Therefore, we have not recorded a loss contingency liability for the MOVEit Vulnerability as of 31 August 2023.”

Progress Software added that it expects to incur further prices of $4.2m associated to a separate cyber safety incident in November 2022, though there are not any particulars about this incident apart from it being disclosed by the agency the following month.

A Progress Software spokesperson advised TechCrunch the November 2022 incident, by which the corporate remained totally operational all through, was not associated to any “recently reported software vulnerabilities”.

Speaking with Recorded Future News, Emsisoft risk analyst Brett Callow, who has tracked the state of affairs because it was first unveiled in May, stated it was very seemingly Clop and different risk actors would use the exfiltrated knowledge to launch additional cyber assaults on different organisations, together with phishing and enterprise e mail compromise assaults.