The number of victims of the widespread MOVEit hack grew by several million Thursday after CalPERS and insurer Genworth Financial said personal information entrusted to them had been compromised.
Both said a third-party vendor, PBI Research Services, was affected in a data theft hack, providing a path for the hackers to then steal data from CalPERS, the nation’s largest pension fund, and Genworth. PBI could not be reached for comment.
CalPERS, whose members include state employees, said on June 6 that PBI told them of a “vulnerability” in their MOVEit Transfer software that allowed hackers to download “our data” without specifying how many people were impacted.
News reports said information from more than 700,000 CalPERS members and retirees was taken.
The MOVEit software is widely used by organizations around the world to share sensitive data.
Genworth Financial was harder hit, saying personal information of up to 2.7 million of its customers was breached.
“The personal information of a significant number of insurance policyholders or other customers of (the company’s) life insurance businesses was unlawfully accessed,” Genworth said.
From U.S. government departments to the UK’s telecom regulator and energy giant Shell, a range of victims have emerged since Progress Software, based in Burlington, Mass., found the security flaw in its MOVEit Transfer product last month.
The insurer said it is working to connect impacted individuals to “protection services,” according to a regulatory filing.
Data taken from CalPERS included members’ first and last names, date of birth and social security number. It serves more than 2 million members in its retirement system.
The MOVEit hack has hit several state and federal agencies. Last week, the U.S. Department of Energy got ransom requests from the Russia-linked extortion group Cl0p at both its nuclear waste facility and scientific education facility, both recently hit in a global hacking campaign.
Data was compromised at the two DOE entities after hackers breached their systems through a security flaw in MOVEit Transfer.
The wide-ranging impact of the hack shows how even the most security-minded federal agencies are struggling to defend against ransomware attacks. Ransomware gangs typically scour for such widely-used tools.
(Reporting by Niket Nishant in Bengaluru and Chris Sanders in Washington DC; Editing by Maju Samuel and Daniel Wallis)
