British Airways, Boots and the BBC are among several victims of a recent hacking campaign that targeted their payroll provider, Zellis. The cyber attack, which has resulted in the potential compromise of personal information, has also affected the government of Nova Scotia. Cyber security experts have warned that thousands of companies, especially payroll providers, information technology companies and healthcare providers using MOVEit, Progress Software Corp's secure file transfer system, could fall prey to the same vulnerability exploited in the attack.
Reports suggest that this vulnerability resulted in the theft of files uploaded by companies on MOVEit, leading to a possible data breach. Progress has since released a patch for this flaw. MOVEit blamed the vulnerabilities in the secure file transfer product, rather than an issue with their software. Experts like Allan Liska, Senior Intelligence Analyst at Recorded Future Inc., have warned that companies with vulnerable MOVEit servers could be targeted by criminal hackers demanding payment in cryptocurrency to prevent them from uploading stolen data.
The flaw has been the subject of numerous security alerts by government cybersecurity agencies, tech firms such as Microsoft and Mandiant, a subsidiary of Alphabet Inc.'s Google Cloud. Experts have attributed the same group of ransomware and extortionist hackers involved in the attacks on Accellion and Fortra secure file transfer products to the MOVEit hack.
Mandiant's CTO, Charles Carmakal, disclosed that the earliest observation of the MOVEit hack occurred on May 27th. It's expected that the criminals responsible for the attack will start contacting companies for payment within the next four weeks. As for the extent of the damage caused by this cyberattack, British Airways disclosed that the attack resulted in the exposure of personal information belonging to employees, including some banking details.
Boots, with over 50,000 employees, confirmed that their employees were also affected by the attack. Meanwhile, the BBC has confirmed that it was one of the firms attacked by Zellis. The Nova Scotia government has not disclosed the exact nature of the information stolen but has confirmed that a breach occurred. The attack seems to point to a classic supply chain attack that simultaneously targets multiple companies storing highly sensitive information about their employees.
Experts have warned that affected firms should urgently install the security patch offered by Progress to remain protected. These attacks underline the need for greater cybersecurity in solutions used by third-party providers, especially those that handle sensitive employee data.