MOVEit - One Tool - Over 250+ Major Organizations hacked. | July 11, 2023
Channel: Hacking Space Frontier 
Date: 11/07/2023

A recently exploited vulnerability in a popular file transfer tool has affected over 250 organizations, including major corporations such as Radisson Hotels, Choice Hotels, American National Insurance Company, Sun Life, TD Ameritrade, and several universities. Hackers exploited a vulnerability in the software known as MOVEit, resulting in data breaches and unauthorized access to sensitive information.

Radisson Hotels confirmed that guest records were involved in the data breach, although they did not disclose the exact number of affected guests. Choice Hotels, which acquired Radisson Hotels, acknowledged the vulnerability and stated that they are notifying affected guests while continuing their investigation. American National Insurance Company and Sun Life, two major insurance providers, also confirmed the data breach and initiated investigations into the extent of the compromised data.

The Clop ransomware group is identified as the primary hacking group exploiting the MOVEit vulnerability. Various organizations, including schools, banks, and companies, have reported their exposure to this issue. The number of victims identified by ransomware expert Brett Callow has reached 254, with approximately 17.7 million people's information exposed. Many of the affected victims have connections to PBI Research Services, the National Student Clearinghouse (NSC), or the Teachers Insurance and Annuity Association of America (TIAA).

Universities such as the University of Illinois and the University of Louisville have communicated with their students and staff about the incident, with some students' data potentially compromised. The University of Utah has also issued a similar message to its students. The federal government issued a warning about three new vulnerabilities discovered in the MOVEit file transfer software, adding to the previous issues identified since the end of May.

The situation is ongoing, with affected organizations dedicating significant resources to address the breaches, cooperate with regulators, and protect individuals' information.