MOVEit victim count latest: 2.6K+ orgs hit, 77M+ people's data stolen
According to security shop Emsisoft, 2,620 organizations and more than 77 million individuals have been impacted to date, with millions in the past weeks alone have received notifications that their info was either accessed, leaked, or both after the Russian ransomware gang Clop exploited a security hole in MOVEit back in May to steal files from compromised instances.
Embarrassingly antivirus biz Avast is among these new-ish victims, which recently disclosed the crooks accessed some "low-risk customer personal information." "We take this seriously and are notifying impacted customers and offering dark web monitoring services free of charge," the developer xeeted on October 25.
In more MOVEit news, Welltok, which provides patient communication services for healthcare providers across the US, has been busy notifying patients that their supposedly private healthcare data really isn't.
The Virgin Pulse-owned company has sent notification letters to more than 1.6 million patients alerting them that their names, addresses, dates of birth, and health information may have been stolen by miscreants abusing MOVEit, according to a November 18 filing with the Maine Attorney General's office.
Specifically, this information belonged to people with group health plans from Stanford Health Care, Stanford Health Care, Lucile Packard Children's Hospital Stanford, Stanford Health Care Tri-Valley, Stanford Medicine Partners, and Packard Children's Health Alliance.
Welltok did not immediately respond to The Register's request for comment.
In a letter sent to those affected patients, Welltok says it first learned that its MOVEit instance had been compromised back in July, after it had "previously installed all published patches and security upgrades immediately upon such patches being made available by Progress Software."
The Register 11/20/2023