Progress Software (MOVEit): CVE-2023-34362 SQL injection in MOVEit Transfer leads to mass data theft
A pre-authentication SQL injection vulnerability in Progress's MOVEit Transfer file-transfer software was exploited by the Cl0p ransomware group to exfiltrate data from over 2,700 organisations.
2 of the 3 practices that failed in this incident are part of the Sentinel-10 — the engineering protocols Concordance flags as most degraded under AI-accelerated development.
This incident pre-dates today's AI-velocity surge. The thesis is that the same practices that failed here will fail faster under AI velocity if not actively governed. Read the Velocity Governance thesis →
Impact
Affected 2,700+ organisations and 95M+ individuals. IBM's Cost of a Data Breach Report estimated cumulative cost at $12B+. Among largest supply-chain breaches in history.
Root cause (from published RCA)
A SQL injection vulnerability existed in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to the MOVEit Transfer database. The vulnerability had existed in the codebase prior to discovery and was not detected by internal security scanning.
Concordance protocols that map to this root cause
Click any protocol to see every other indexed incident where it failed.
Primary sources
Related incidents
Other incidents that failed at least one of the same protocols.