Major Cybersecurity Breach: Shell, BBC, British Airways & More Targeted by Clop Gang | June 15 2023
Channel: Hacking Space Frontier 
Date: 15/06/2023

Shell, a British oil and gas multinational, confirmed that it had been affected by a breach carried out by the Clop ransomware gang. The breach targeted the MOVEit file transfer tool, and Shell is the second time victim of the Clop gang's attack on a file transfer service. While Shell stated that there was no evidence of impact on its core IT systems, a small number of its employees and customers were affected through the compromised tool. Shell's IT teams are investigating the incident and stated that they are not communicating with the hackers.

The Clop gang's attack on MOVEit has affected various organizations in the UK, including the BBC, British Airways, Aer Lingus, Boots (a pharmaceutical retailer), and Ofcom (the country's communications regulator). Ofcom reported that a limited amount of information was downloaded in the attack, including confidential data related to the companies it regulates and personal data of 412 Ofcom employees. The BBC, British Airways, Aer Lingus, and Boots may have a higher exposure to the breach as the file transfer tool was used by a third-party supplier called Zellis, which provided payroll services to these companies. Transport for London, which operates public transport in the capital, has also confirmed being impacted by the incident, with personal data of up to 13,000 drivers being stolen.

The professional services firm EY was also affected by the breach, although it is unclear if they were a Zellis customer or directly used the MOVEit Transfer tool. Both the BBC and British Airways have warned their entire payrolls that their data may have been stolen. This is not the first time Shell has been targeted by the Clop gang, as they were previously attacked in 2021 through the hacking of Accellion's file transfer appliance. The gang's attacks on various file transfer tools aim to extort companies by threatening to leak stolen sensitive information. Progress, the software company that develops MOVEit, recently announced a second vulnerability affecting the software, leading to more breaches linked to the program's issues.