MOVEit vulnerability and data extortion incident
What has happened?
Criminals have exploited a vulnerability in Progress Software’s MOVEit file transfer app, which is used by thousands of organisations around the world.
A number of organisations whose supply chains use the MOVEit app have suffered a data breach as a result, with customer and/or employee data being stolen.
The NCSC is working with UK organisations to understand and respond to this incident. We will continue to update this page as more information becomes available.
Who is affected?
Organisations around the world have been affected by this incident, some of which have confirmed that personal data may have been stolen.
What can I do?
If you work for an affected organisation, and you are concerned about your personal information, follow our guidance below for individuals affected by a data breach.
If you are an organisation directly affected by this vulnerability, see our guidance for organisations.
Advice for individuals affected
Anyone who believes their information has been compromised as a result of this incident (staff or customer of the affected organisations) can find out how to protect themselves from the impact of the breach.
Advice for organisations affected
For organisations directly affected, Progress (the vendor of the MOVEit software) has issued updated advice on mitigating this vulnerability, which includes a new patch for additional vulnerabilities that could be exploited. MOVEit customers should apply the latest vulnerabilities fixes, as described in the MOVEit Transfer Knowledge Base Article(Updated 15th June).
The NCSC offers extensive guidance on preventing and mitigating malware attacks.
Cyber attacks like this that target organisations' supply chains (rather than the organisation directly) are increasingly common. In addition to our well-established Supply chain principles, we have recently provided:
The NCSC's position, along with law enforcement, is that we don’t endorse, promote or encourage the payment of ransoms.
Read more in our joint blog with the Information Commissioner's Office (ICO) on why it’s a myth that paying the ransom makes the incident go away.
What if we have been compromised because of this vulnerability?
If you are a UK organisation compromised by this vulnerability, use the government's sign-posting service to report the incident.
