MOVEit campaign (2023)

In late May 2023, the criminal group Cl0p exploited a previously unknown vulnerability in MOVEit Transfer, a file transfer product widely used by public bodies, banks, insurers, universities and payroll providers to exchange large files. Within days it extracted data from thousands of organizations, directly or through their service providers, then threatened to publish it, without encrypting any system. The case became a textbook example for cyber underwriting. It shows that a single, barely visible piece of software can create accumulation across every sector and company size. It shows that extortion through data theft alone, without encryption, is enough to produce massive notification, investigation and liability costs, while business interruption stays low. And it illustrates accumulation through the supplier chain, since many victims did not use the software themselves but entrusted their data to a third party that did. For the underwriter, the lesson concerns the inventory of its insureds' software dependencies, which it almost never knows.