At the end of May 2023, Progress Software disclosed a significant zero-day vulnerability (CVE-2023-34362) in its MOVEit Transfer software, which Clop had been exploiting since 27 May, according to CISA. The attack on MOVEit software, a business unit of Progress Software, by the notorious Clop ransomware gang sent shockwaves through the cybersecurity community.
On June 7th, the Clop ransomware gang boldly announced on its blog that it was behind the attacks. Clop broke into internet-facing MOVEit Transfer servers run by many organizations; one of them was the UK payroll provider Zellis, which said that data from eight of its client firms had been stolen. This breach compromised organizations worldwide, leaving a considerable number of victims in its wake.
Organizations Impacted by the Attack
- The US Department of Energy,
- Shell company
- First National Bankers Bank
- Putnam Investments
- Datasite
- Swiss insurance company ‘ÖKK’
- Leggett & Platt
- Multinational firm PricewaterhouseCoopers (PwC)
- Ernst & Young
- Health Services Ireland
- BBC
- British Airways
- Boots Retail
- Medibank
- Rochester Hospital
- GreenShield Canada
- National Student Clearinghouse
- United Healthcare Student Resources
- University System of Georgia
- German brand Heidelberg
- Aer Lingus
- Government of Nova Scotia
- Johns Hopkins University
- Ofcom
- Transport for London (TfL)
Microsoft, in its investigations, attributed the attacks to Lace Tempest, a group known for ransomware operations and for running the Clop extortion site. This revelation further highlighted the potential targeting of health organizations and financial institutions by the malevolent gang. The threat of file encrypting malware and double extortion tactics continues to grow, underscoring the urgency to bolster cybersecurity measures.
Correction, 26 October 2026: this article said the risk analysis firm Kroll discovered the vulnerability, that Clop got in through Zellis, and that Microsoft linked the suspects to Russian intelligence; Progress Software disclosed the vulnerability, Clop exploited many organizations’ own MOVEit Transfer servers (Zellis was one victim), and Microsoft attributed the attacks to Lace Tempest, the operator of the Clop extortion site.