MOVEit Vulnerability: What to Know and What to Do
Client Alert | 2 min read | 06.07.23
A new Cybersecurity & Infrastructure Security Agency (CISA) alert advises that, starting in late May, a well-known ransomware group called Clop compromised a widely used managed file transfer (MFT) platform called MOVEit Transfer, reportedly impacting hundreds of companies globally.
MFT platforms are used to securely transfer files between parties, and Clop reportedly compromised MOVEit Transfer using a previously unknown (zero-day) vulnerability that allowed attackers to steal files from MOVEit’s underlying database. This vulnerability is now tracked as CVE-2023-34362.
Clop has previously targeted MFT platforms such as Accellion and has shown that it is prepared to follow through on threatened next steps. In this case, Clop is threatening to identify victim companies on the Clop site as soon as June 14 and then, if a ransom is not paid, publish victims’ stolen data. In prior attacks, Clop has also reportedly contacted victim companies directly with ransom demands, sometimes weeks or more after the attack. We do not recommend that victims contact threat actors like Clop directly but instead work with experts to do so safely, if necessary.
Organizations that may be victims of this attack should consider the following steps:
- Organizations that used the MOVEit Transfer platform with its web interface exposed to the internet should consider initiating a privileged investigation to determine if they were impacted by this attack.
- Organizations with vulnerable MOVEit Transfer systems should consider reviewing available guidance and patching information from Progress Software, the maker of MOVEit Transfer, and be vigilant for additional attempts at exploitation and data theft, as well as other attacks targeting these systems (e.g., the deployment of ransomware encryptors). Progress Software, the maker of MOVEit, has provided information about the vulnerability, patching and recommended mitigation here: https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability.
- If your organization was impacted, assess the attacker’s level of access and what data was compromised.
- Based on the data compromised, determine your organization’s notification requirements under applicable laws, regulations, and contracts.
- Organizations should also consider reviewing their supply chains and other counterparties to determine if their data may have been exposed through third parties’ use of the MOVEit Transfer platform.
Crowell & Moring attorneys are monitoring developments and stand ready to support affected businesses.
Contacts
Insights
Client Alert | 2 min read | 09.22.25
Department of Education Discontinues Discretionary Grant Funding for Minority-Serving Institutions
The Department of Education (DOE) announced on September 10, 2025, that it will end discretionary funding to several Minority-Serving Institution (MSI) grant programs that, it stated, “discriminate by conferring government benefits exclusively to institutions that meet racial or ethnic quotas.”[1] The agency stated that it would “us[e] its statutory authority to reprogram discretionary funds to programs that do not present such concerns.”[2] This announcement follows a July 2025 decision by the Department of Justice to no longer defend the constitutionality of a provision of the Higher Education Act of 1965 (HEA) that authorizes grant funding to Hispanic-Serving institutions, after determining that such programs “violate the equal-protection component of the Fifth Amendment’s Due Process Clause.”[3]
Client Alert | 9 min read | 09.22.25
From Deepfakes to Sanctions Violations: The Rise of North Korean Remote IT Worker Schemes
Client Alert | 4 min read | 09.22.25
The Future of Special Contracts in Belgium: a new Book 7 for the Belgian Civil Code