a tool our vendors use isn't our problem

what everyone assumed

An organization picks its vendors carefully, and trusts that those vendors have picked theirs. The boundary of responsibility feels obvious: you secure what you run, your suppliers secure what they run, and a file-transfer product four steps down the chain is somebody else’s audit. It is a reasonable place to draw the line, because the alternative, knowing every tool your vendors’ vendors use, sounds impossible.

what happened

On May 27, 2023, the Clop ransomware group began exploiting a previously unknown SQL injection flaw, later catalogued as CVE-2023-34362, in Progress Software’s MOVEit Transfer. MOVEit is the kind of product most affected organizations never bought directly; it sat inside payroll providers, benefits administrators, government agencies, and other vendors who used it to move data. Progress released a patch on May 31, but exploitation had already begun, and the access propagated the way file transfers do: through the relationships between companies. A breach of one MOVEit instance was a breach of everyone whose data passed through it, and many of those people had no contractual relationship with the company that ran the server.

how it surfaced

The scale arrived in waves through the second half of 2023 as victim after victim disclosed. CISA and the FBI issued an advisory on the campaign. By the counts that settled later, the cascade reached more than two thousand organizations and the records of over sixty million individuals, most of them people who had never heard of MOVEit and a good number reached through a vendor of a vendor. The assumption retired itself one disclosure letter at a time, each from an organization explaining a breach of a tool it had never installed.

Your attack surface is not the list of tools you run; it is the list of tools that touch your data, including the ones three companies removed from you.

A vendor’s flaw becomes your incident the moment your records pass through it.