This is according to Reuters, which cites information from software company Progress Software, which exposed the vulnerability earlier this week and warned that it might result in unauthorized access to clients’ computers.
The report claims that it is unknown whose companies use the software and are potentially impacted by the breaches, but Ian Pitt, chief information officer at Progress Software, said that his business has made available fixes ever since finding the problem on May 28.
Security expert Kevin Beaumont claims that in addition to having an effect on customers of MOVEit’s cloud platform, the vulnerability also poses a security risk to multiple “big banks” and the US Department of Homeland Security.
Reuters claims that two companies, cybersecurity company Rapid7 and Google-owned Mandiant Consulting, have exposed several instances in which hackers have taken advantage of the problem to steal data.
In a statement, Charles Carmakal, chief technical officer of Mandiant Consulting, stated that “mass exploitation and widespread data theft have occurred in recent days.”
In the past, these “zero-day,” or previously unknown, vulnerabilities in controlled file transfer systems have led to data theft, breaches, extortion, and victim-shaming, according to the Mandiant statement.
Organizations should be ready for future extortion and disclosure of stolen data, Carmakal said, even if Mandiant does not yet know the intent of the threat actor.
