ALT-48 · Analysis · 23 Oct 2026
MOVEit: one file-transfer bug, thousands of organisations
A ransomware group used an unknown SQL injection flaw in a file-transfer product to steal data from thousands of organisations — without encrypting anything. Mass exploitation, then mass extortion.
- 27 May 2023Exploitation begins over a US holiday weekend.
- 31 May 2023Progress discloses the vulnerability and releases a fix.
- 7 Jun 2023CISA and the FBI publish a joint advisory on Cl0p.
Why it spread so far
File-transfer servers exist to hold sensitive files and to face the internet. Many organisations' data sat on suppliers' MOVEit servers; they learned of their exposure from the supplier, sometimes weeks later.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Managed file transfer is a recurring target; the same group exploited similar products before.
- Extortion without encryption is still ransomware, and backups do not help against it.
- Your data's exposure includes every supplier who holds a copy.
What to do
- Keep file-transfer servers patched within days and off the public internet where possible.
- Delete files from transfer servers after delivery.
- Ask suppliers which file-transfer tools hold your data.
Sources
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-48 — MOVEit: one file-transfer bug, thousands of organisations. 23 Oct 2026. altumptic.com/research/moveit-2023