If you received a MOVEit breach notice, secure passwords, check financial accounts, then protect credit. MOVEit Transfer is file-transfer software that organizations use to move sensitive files.
Exposure was often indirect because a school, agency or vendor used MOVEit, not you. Files were taken from a provider's MOVEit platform beginning about May 28, 2023. Use the checklist below to limit credential-stuffing, account takeover and new-account fraud.
Table of Contents
- Why a MOVEit notice can apply to you
- Change passwords and turn on MFA
- Check bank, card and financial accounts
- Freeze credit, add alerts and report fraud
Why a MOVEit notice can apply to you
CL0P exploited SQL-injection zero-day CVE-2023-34362 in Progress MOVEit Transfer starting May 2023, according to the CISA-FBI joint advisory. Attackers installed LEMURLOOT web shells and stole underlying databases.
You did not need a MOVEit account to be affected. If your school, agency or vendor moved files through MOVEit, your record could be included.
Change passwords and turn on MFA
Change passwords on important online accounts to unique passwords. Turn on multi-factor authentication where available.
According to the University of Alaska breach guidance, stolen names, addresses and credentials enable credential-stuffing and account takeover. An attacker with your name, address and old password can try the same pair on many sites. Unique passwords and MFA block that reuse.
- Start with email, banking and other important online accounts.
- Set a unique password for each account.
- Turn on multi-factor authentication everywhere it is offered.
Check bank, card and financial accounts
USA.gov identity-theft guidance advises close review of bank, card and financial statements for unfamiliar charges. It also advises closing or freezing compromised accounts and asking the institution for new cards or account numbers.
Flag unfamiliar charges, even small ones, and dispute those you did not authorize. Ask the bank or card issuer for a new card or account number if fraud is confirmed.
- Review every bank, card and financial statement line by line.
- Call the institution about unfamiliar charges and request new cards or numbers.
- Dispute unauthorized charges and close or freeze compromised accounts.
Freeze credit, add alerts and report fraud
Place a credit/security freeze to block new-account openings, as recommended in USA.gov identity-theft guidance. It is free and must be set separately with Equifax, Experian and TransUnion. You can temporarily lift the freeze when applying for credit. The Office of the Comptroller of the Currency explains that contacting one bureau places an initial fraud alert and notifies the other bureaus. Lenders must then take extra steps to verify identity before issuing new credit.
Request free weekly credit reports from each bureau through AnnualCreditReport.com, the only federally authorized source, as noted in the FTC consumer alert. Look for unknown accounts or inquiries after a MOVEit notice. Report confirmed misuse at IdentityTheft.gov to receive an FTC Identity Theft Report and personalized recovery plan. CISA warns that patching MOVEit, freezing credit and enrolling in monitoring cannot retrieve data CL0P already copied. Freezes also do not stop fraud on existing accounts or phishing using stolen contacts, so keep reviewing statements and suspect breach-related messages.
You Might Also Like
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit
- Cybersecurity — Snowflake Customer Breach Prevention Guide: Controls, Monitoring, and Recovery
- Vendor Data Breach Investigation Guide: Evidence, Notices, and Verification