Article Details
Scrape Timestamp (UTC): 2024-08-07 22:38:58.501
Original Article Text
Click to Toggle View
SEC ends probe into MOVEit attacks impacting 95 million people. The SEC has concluded its investigation into Progress Software’s handling of the widespread exploitation of a MOVEit Transfer zero-day flaw that exposed data of over 95 million people. In a new FORM 8-K filing with the SEC, Progress Software says that the SEC's Division of Enforcement will not recommend any enforcement action regarding the security incident. "The SEC has notified Progress that it does not intend to recommend an enforcement action against the company at this time," reads the Thursday evening SEC filing. "As previously disclosed, Progress received a subpoena from the SEC on October 2, 2023, as part of a fact-finding inquiry seeking various documents and information relating to the MOVEit vulnerability." The SEC has been investigating Progress Software’s handling of widespread data theft attacks conducted through a zero-day vulnerability in the MOVEit Transfer software. As first reported by BleepingComputer, during the 2023 Memorial Day holiday weekend, the Clop ransomware gang took advantage of the zero-day vulnerability to launch a large-scale data theft campaign against companies worldwide. According to Emsisoft, which has been tracking the impact of the attacks, over 2,770 companies and 95 million people had data stolen through the zero-day flaw. The Clop gang was projected to earn between $75-100 million in ransom payments due to the broad impact of the attacks, which included government agencies, financial firms, healthcare orgs, airlines, and educational institutions. While the SEC is not recommending any action, Progress Software still faces hundreds of class-action lawsuits centralized in the Massachusetts federal courts.
Daily Brief Summary
The SEC completed its investigation into Progress Software's response to a zero-day exploit in MOVEit Transfer, deciding not to recommend enforcement action.
This security breach, exploited via a previously unknown vulnerability, affected over 2,770 companies globally and compromised the data of approximately 95 million individuals.
The Clop ransomware gang utilized this vulnerability during the 2023 Memorial Day weekend, resulting in significant data theft across various sectors including government, finance, healthcare, airlines, and education.
Despite the SEC's decision not to pursue enforcement, Progress Software is facing numerous class-action lawsuits consolidated in the Massachusetts federal courts.
The criminal exploitation of the vulnerability has reportedly netted the Clop gang between $75 and $100 million in ransom payments.
Progress Software was initially subpoenaed by the SEC on October 2, 2023, as part of the regulatory body's investigation into the handling of the data theft incidents.