The zero-day vulnerability exploited in Progress Software’s MOVEit file transfer software has not only resulted in a widespread attack but has also triggered multiple legal inquiries and investigations. As disclosed in a regulatory filing, the company now finds itself facing an onslaught of attorneys seeking redress. The incident, which occurred in May, has attracted the attention of prominent organizations, including the U.S. Securities and Exchange Commission (SEC).
U.S. Securities and Exchange Commission (SEC) Investigation
Progress Software recently revealed that the SEC is among the organizations investigating the mass attack on its MOVEit software. The company received a subpoena on October 2, demanding documents related to the incident. However, it is important to note that the SEC’s involvement is part of a fact-finding inquiry, and it does not automatically imply that Progress Software or any other party has violated federal securities laws.
Extent of the Attack
The attack, orchestrated by the Clop ransomware group, has had a severe impact on numerous organizations and individuals. An independent count suggests that over 2,500 organizations and an astounding 64 million individuals, both directly and indirectly, have been affected by this large-scale breach. The extent of the attack highlights the urgency of addressing the vulnerabilities in Progress Software’s MOVEit software.
Attack Details
The cyberattack, believed to have been launched by the Russian-speaking Clop ransomware group, targeted instances of MOVEit around May 29, coinciding with the U.S. Memorial Day holiday weekend. By exploiting the zero-day vulnerability, the attackers executed a highly automated mass attack.
Other Inquiries and Investigations
In addition to the SEC’s involvement, Progress Software is also cooperating with several other inquiries. The company is liaising with domestic and foreign data privacy regulators, as well as responding to inquiries from several state attorneys general. Furthermore, a federal law enforcement agency is conducting its own investigation into the incident. These inquiries highlight the seriousness of the breach and the need to hold those responsible accountable.
Financial Impact
Despite the significant disruption caused by the mass attack, Progress Software has not experienced a substantial financial impact. As a publicly traded company, it is reassuring to shareholders and investors that the attack has not significantly affected the company’s financial stability. This suggests that appropriate cybersecurity measures were in place.
Cybersecurity Insurance Coverage
To mitigate the potential financial impact of cyberattacks, Progress Software had $15 million worth of cybersecurity insurance in place during the MOVEit attacks. This coverage provided some level of protection against the fallout from the incident. As of now, the company still has $10.1 million available from the insurance policy, providing a financial cushion against future expenses related to the attack.
Anticipated Future Expenses
Unfortunately, the legal inquiries and investigations are likely to result in additional expenses for Progress Software. The company expects to incur costs for further investigation, legal representation, and professional services. While the extent of these expenses remains uncertain, the ongoing legal proceedings are likely to become a financial burden.
Progress Software finds itself entangled in legal inquiries and investigations following the mass attack on its MOVEit file transfer software. The involvement of the SEC and other regulatory bodies underscores the severity of the breach and the need to address vulnerabilities promptly. While the financial impact on the company has been limited thus far, the future expenses associated with investigations and legal proceedings present a potential challenge. Moving forward, Progress Software must not only rectify the flaws in its software but also cooperate fully with the authorities to ensure accountability for the attack and prevent future breaches.