The Cl0p MOVEit breach was a mass data-theft campaign that began on May 27, 2023, when the Cl0p ransomware gang exploited an unknown SQL injection flaw (CVE-2023-34362) in Progress Software's MOVEit Transfer, a managed file transfer product businesses use to move sensitive files. According to CISA and FBI advisory AA23-158A, the gang planted a web shell called LEMURLOOT on internet-facing MOVEit servers and pulled data straight out of the underlying databases. The scale is what makes this breach a case study. Emsisoft's tracker counts roughly 2,773 affected organizations and more than 95 million individuals, and the numbers kept climbing for years because MOVEit sat inside vendor supply chains — one compromised server exposed many downstream clients.
Table of Contents
- What happened, step by step
- Why this wasn't a typical ransomware attack
- Who was exposed, and how badly
- The government and legal response
- What defenders should take from it
- Frequently Asked Questions
What happened, step by step
Exploitation started May 27, 2023, over the US Memorial Day weekend — a deliberate choice, since security teams were thin. Cl0p (also tracked as TA505) used the SQL injection flaw to deploy LEMURLOOT, a web shell disguised as a legitimate MOVEit component, and exfiltrated file contents and account data at scale. Progress Software published its advisory on May 31, 2023, shipping patched versions for every supported release line and urging customers to block HTTP and HTTPS traffic to MOVEit until they patched.
The CVE was assigned June 2 — the same day CISA added it to the Known Exploited Vulnerabilities catalog. On June 7, CISA and the FBI issued the joint #StopRansomware advisory with indicators of compromise and mitigation steps, including taking MOVEit systems offline to patch. That is a four-day window from first exploitation to vendor advisory, and roughly ten days to a full government advisory. For most victims, though, the data was already gone before the first patch existed.
Why this wasn't a typical ransomware attack
Cl0p never encrypted anything. The campaign was pure extortion: steal the files, then threaten to publish them on the gang's leak site unless the victim paid. There was no operational outage to recover from — only stolen data and the decision of whether to pay to keep it off the internet. This changed the victim's calculus. With encryption ransomware, paying can restore operations.
Here, paying only bought a promise from a criminal group not to publish data it already held. Many organizations declined, and Cl0p published in waves through mid-2023. The other defining feature was indirect exposure. TechCrunch's accounting of the campaign notes that the BBC, Boots, and British Airways were all breached through their payroll provider Zellis — none of them ran MOVEit themselves. The US Department of Energy was among affected federal agencies. If a vendor of yours moved your data through MOVEit, you were in scope whether or not you had ever heard of the product.
Who was exposed, and how badly
Emsisoft's continuously updated tracker puts the totals at about 2,773 organizations and over 95 million individuals, with more than 80% of known corporate victims based in the US. That makes MOVEit one of the largest breach events on record.
The biggest single exposures clustered in government-adjacent data holders — organizations that hold identity records for entire populations: For individuals in those states, exposure was close to universal among licensed drivers. The stolen data typically included names, Social Security numbers, and driver's license details — the raw material for identity theft, which does not expire the way a stolen password does.
- Maximus, a US government services contractor: over 11 million people
- Louisiana Office of Motor Vehicles: about 6 million records
- Oregon DMV: about 3.5 million records
The government and legal response
On June 16, 2023, the State Department's Rewards for Justice program offered up to $10 million for information linking Cl0p or similar actors targeting US critical infrastructure to a foreign government, with tips accepted through a Tor SecureDrop server. Progress Software faced regulatory scrutiny but emerged without enforcement. The SEC subpoenaed the company on October 2, 2023, then closed its fact-finding investigation in an August 7, 2024 letter stating it would not recommend enforcement action.
Civil liability is a different story and still open. In the consolidated multidistrict litigation in the District of Massachusetts, Judge Allison Burroughs on July 31, 2025 largely denied Progress's motion to dismiss, allowing negligence, breach of contract, and consumer-protection claims to proceed. Early settlements from co-defendants include Nuance Communications at $8.5 million — a signal of where the broader litigation may land.
What defenders should take from it
The durable lesson is about managed file transfer systems specifically: they are internet-facing by design, they hold concentrated batches of sensitive data, and they are attractive enough that Cl0p had already hit two similar products (Accellion FTA and GoAnywhere MFT) before MOVEit. Treat them as crown-jewel infrastructure, not plumbing.
Practical steps, drawn from the CISA/FBI mitigations and the campaign's shape: Victim counts were still rising years after the patch shipped, because downstream organizations kept discovering their data had passed through someone else's MOVEit server. An accurate answer to "were we affected?" requires mapping your vendors' tooling, not just your own.
- Inventory every internet-exposed file transfer system you run — and ask your vendors which ones they run with your data.
- When a critical advisory lands for one, take it offline first and patch second; the MOVEit window between exploitation and advisory was four days.
- Write vendor contracts that require breach notification and name the transfer tooling in scope, because your customers will hold you responsible for your vendor's server.
- Assume data theft, not just encryption, in incident response plans — backups do not help when the harm is publication.
Frequently Asked Questions
Was MOVEit itself insecure after the breach?
Progress patched CVE-2023-34362 on May 31, 2023 across all supported versions. The exposure came from unpatched, internet-facing servers and from data stolen before the patch existed.
Did paying Cl0p protect victims' data?
Payment only bought a promise not to publish data the gang already held. Cl0p ran no encryption, so there was nothing to decrypt and no operational recovery to buy.
How would I know if my data was involved?
Exposure often came through vendors — payroll processors, contractors, state agencies — rather than companies you deal with directly. Breach notifications from entities like Maximus or a state DMV are the usual signal, and they continued arriving years after the attack.
You Might Also Like
- Ransomware Attacks 2026 Guide: exposure, response, and recovery; Key Facts and Questions to Ask
- Cybersecurity — RansomHub Guide 2026: What Happened, Who Is Affected, and Next Steps
- Cybersecurity — ALPHV BlackCat Update 2026: Disclosure, Response, and Open Questions