A SQL injection zero-day in Progress Software's MOVEit Transfer managed file transfer product was mass-exploited by the Cl0p ransomware group, producing one of the widest supply-chain data exposures on record. The flaw is tracked as CVE-2023-34362, rated critical by Tenable and carrying a CVSS 3.1 score of 9.8 per the NVD entry cited by 0dayNews. Victim counts vary sharply by source and by counting method: HackTheBox puts direct exfiltration at approximately 130 victims over a 10-day window, Kovrr cited "over 100 targets" in its June 2023 assessment, 0dayNews describes "dozens of organizations, later reporting confirmed hundreds," and WebProNews reports researchers estimating more than 2,500 organizations affected with hundreds of terabytes stolen. Readers should note that Kovrr's 2,500 figure refers to exposed internet-facing devices, not confirmed victim organizations, so the headline number in circulation may conflate two different measurements.
What Happened
Per the Tenable advisory, the vulnerability affects MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), plus all older versions including unsupported releases such as 2020.0 and the 2019 branch. Tenable confirms exploitation in the wild during May and June 2023 via both HTTP and HTTPS.
Accounts differ on the disclosure date. 0dayNews and Kovrr both place Progress Software's patch and public disclosure on June 2, 2023. Cypro's Estée Lauder timeline instead dates disclosure and patching to May 31, 2023. WebProNews states only that Progress became aware in late May after unusual activity surfaced in customer environments.
The exploitation start date is more consistent. Kovrr states attackers were active as early as May 27, 2023. The Ernst & Young and Bank of America class action filing referenced by ClaimDepot alleges unauthorized access between May 27 and May 31, 2023. Cypro places the Estée Lauder intrusion window at May 30 to June 1, 2023. All three predate any of the candidate disclosure dates, which is the defining feature of this incident: retroactive protection was not possible, and Kovrr says so explicitly.
Microsoft attributed the campaign to Lace Tempest, the actor behind Cl0p, according to Kovrr. Cl0p claimed responsibility publicly on its leak site. In at least one case the picture is more crowded: Cypro reports that both Cl0p and ALPHV/BlackCat listed Estée Lauder on their extortion sites on July 19, 2023, with BlackCat actors maintaining a presence into July and August.
What Was Taken
The data classes reported across sources are consistent even where volumes are not. WebProNews lists employee records, financial documents, health information, and material it characterizes as classified, drawn from banking, defense, government, airline, and healthcare victims. The LinkedIn analysis by Himanshu Palhade enumerates PII, employee records, financial documents, contracts and legal files, credentials and session data, and proprietary business information.
Named victims include the BBC, British Airways, Boots, the University of Rochester, and the provincial government of Nova Scotia, per Kovrr. Estée Lauder confirmed through breach notifications filed on August 31 and October 18, 2023 that exposed data included full names, dates of birth, Social Security numbers, and health information, mostly affecting employees and related parties, according to Cypro.
Volume figures diverge by an order of magnitude. WebProNews cites hundreds of terabytes across more than 2,500 organizations. 0dayNews describes Cl0p eventually claiming a victim count "touching tens of millions of individuals." At the single-entity level, ClaimDepot reports the Ernst & Young and Bank of America matter alone affected more than 198,667 individuals, settled for $2.5 million with class member claims up to $12,500. Treat the aggregate totals as estimates from secondary reporting rather than confirmed counts.
Why It Matters
Three years and change after disclosure, this remains a live exposure rather than a closed case. 0dayNews reports CVE-2023-34362 still scoring EPSS 0.99934 as of July 2026, attributing that to ongoing scanning, public proof-of-concept tooling, and a residual population of unpatched internet-facing MOVEit instances. A well-documented, heavily armed, three-year-old vulnerability that still has targets is a governance failure, not a technical one.
The second lesson is structural. Managed file transfer platforms accumulate exactly the material that matters most, payroll, healthcare records, financial documents, precisely because that data transits systems nobody classifies as "the database," as 0dayNews puts it. The blast radius is not the compromised organization; it is every downstream party whose data passed through. The EY and Bank of America settlement illustrates this: individuals whose PII was never held by the breached vendor directly still ended up as class members.
Third, the legal and regulatory tail is long and expensive. Settlements, notification obligations, and litigation were still resolving in 2026.
The Attack Technique
Tenable describes the core flaw as a SQL injection in the MOVEit Transfer web application that lets an unauthenticated attacker reach the underlying database, whether MySQL, Microsoft SQL Server, or Azure SQL. Depending on engine, an attacker can infer database structure and contents and execute statements that alter or delete elements.
HackTheBox documents the post-exploitation stage: Cl0p used the injection to deploy a web shell named LEMURLOOT on MOVEit Transfer web applications. That web shell allowed retrieval of system settings, enumeration of the SQL database, storing and retrieving files from the MOVEit system, and creation of a new administrator-privileged account. HackTheBox also notes the compromise was scoped to the MOVEit platform itself rather than broad lateral movement into victim networks, which is consistent with a smash-and-grab exfiltration model rather than conventional ransomware deployment.
The campaign sequence, as laid out in the LinkedIn analysis, was internet-wide scanning for exposed MOVEit servers, exploitation of CVE-2023-34362 for initial access, direct exfiltration from compromised servers, extortion based on stolen data rather than encryption, and publication on leak sites for non-payers. CISA added the CVE to its Known Exploited Vulnerabilities catalog in June 2023, per both HackTheBox and 0dayNews.
What Organizations Should Do
- Patch every MOVEit Transfer instance to at minimum 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, or 2023.0.1 as specified by Tenable, and audit for forgotten or shadow deployments running unsupported 2019 and 2020 builds. The EPSS score cited by 0dayNews indicates unpatched instances are still being hunted in 2026.
- Assume compromise if any instance was internet-facing and unpatched during the May 27 to June 2, 2023 window. Kovrr is explicit that patching provides no retroactive protection. Hunt for LEMURLOOT artifacts, unexpected administrator accounts, and anomalous database enumeration in historical logs.
- Remove MFT platforms from direct internet exposure. Put them behind VPN, zero-trust proxy, or IP allowlisting so that unauthenticated pre-auth flaws are not directly reachable, a control recommended in the LinkedIn analysis.
- Enforce MFA and strong authentication on all file transfer administration interfaces, and review any administrator accounts created during or after the exposure window.
- Purge data at rest on transfer platforms. MFT systems are conduits, not archives. Aggressive retention limits directly reduce what an attacker can take in a single grab.
- Map third-party and fourth-party MFT exposure. The EY and Bank of America case shows liability follows the data, not the server, so know which vendors process your records and on what platform.
- Maintain continuous log and network monitoring, run regular vulnerability assessment and penetration testing, and keep tested offline backups, per the defensive checklist in the LinkedIn analysis.
Sources: MOVEit Zero-Day Breach Exposes Data of 2,500 Organizations Worldwide | CVE-2023-34362 Tenable® | MOVEit Transfer and the Breach That Defined 2023 — 0dayNews | Understanding CVE-2023-34362: A Critical MOVEit ... | MOVEit File Transfer Vulnerabilities Impacting Orgs Kovrr | Estée Lauder Data Breach: MOVEit Zero-Day Exposed | MOVEit Transfer Supply Chain Attack: Hundreds of Victims, ... | Ernst & Young, Bank of America $2.5M MOVEit Data Breach Settlement