The MOVEit Incident: A Wake-Up Call for Digital Supply Chain Risks

In the summer of 2023, the world was shaken by a large-scale cyber incident involving MOVEit, a widely used solution for secure file exchange. What makes the incident particularly noteworthy is not just its scale, but especially the insight it provided into how vulnerable digital supply chains are. For executives and CISOs of mid-sized organizations, this incident is an important lesson.

MOVEit is used by organizations that need to exchange sensitive data with customers, suppliers, and government agencies. It was precisely this trust in a “proven” solution that made the impact of the incident so significant.

What is MOVEit and why is it so widespread?

MOVEit is a so-called Managed File Transfer (MFT) solution. This is software that organizations use to securely send and receive files, often containing sensitive or privacy-sensitive information such as personal data and financial data. MOVEit was developed by Progress Software, an American software company that has been active in business software for decades.

Many organizations choose these types of solutions because they meet compliance requirements and security standards. As a result, file transfer is often seen as a “checked off” risk, something safely outsourced to a vendor.

What went wrong in the MOVEit incident?

Cybercriminals discovered a vulnerability in MOVEit Transfer, the server variant of the software. Through this vulnerability, they could gain unauthorized access to systems and copy data without leaving immediate traces. This type of vulnerability is also known as a zero-day: a security flaw not yet known to the vendor.

It is important to note that MOVEit users themselves did nothing wrong. Organizations that had properly configured and updated their systems still proved vulnerable. This underscores how dependent you are on the security of your vendors.

The Scale and Impact: Thousands of Organizations Affected

The attacks were attributed to the cybercriminal group Cl0p, which specializes in large-scale data theft and extortion. Thousands of organizations worldwide were affected, including banks, healthcare institutions, educational organizations, and governments.

Dutch organizations were also affected, sometimes indirectly through suppliers or service providers. This includes payroll processors, IT service providers, or logistics partners who used MOVEit for data exchange. As a result, personal data of employees and customers were exposed, without the affected organizations having direct control over it.

Why This is a Typical Supply Chain Incident

The MOVEit incident is not a classic “hacker attacks company” story. It is a textbook example of a digital supply chain incident. The attack targeted one software vendor but had consequences for thousands of organizations in the chain.

For executives, this is an important insight: your digital supply chain consists not only of direct suppliers but also of the software and services they use. The further that chain extends, the more difficult it becomes to oversee and manage risks.

The Executive Reality: Responsibility Remains Yours

Although the vulnerability lay with the vendor, the responsibility remained with the affected organizations themselves. They had to report to regulators, inform those affected, and limit reputational damage. This often leads to difficult questions from customers, regulators, and the media.

For executives, this is a confronting reality: outsourcing reduces operational burdens, but not ultimate responsibility. Digital risks do not stop at the contract with a vendor.

What Can Organizations Learn from This?

The MOVEit incident shows that traditional vendor assessments are no longer sufficient. An annual audit or questionnaire does not provide insight into current vulnerabilities. Organizations would do well to continuously monitor critical vendors and make explicit agreements on vulnerability management and incident response.

Additionally, it helps to gain insight into where sensitive data resides and through which systems it is exchanged. Many organizations only realize how complex their digital chain truly is during an incident.

From IT Problem to Strategic Risk

What MOVEit primarily makes clear is that supply chain security is no longer purely an IT topic. It affects business continuity, compliance, reputation, and trust. As such, it belongs on the agenda of management and the board.

By explicitly naming and discussing supply chain risks, organizations can invest more targetedly in resilience. Not by doing everything themselves, but by making more conscious choices in vendors, contracts, and oversight.

Conclusion: Awareness is the First Step

The MOVEit incident was not an exceptional event, but a harbinger of what will occur more frequently. Digital ecosystems are becoming more complex, and attackers are increasingly targeting links that affect many organizations simultaneously.

For mid-sized organizations, it is therefore essential to look beyond their own walls. Those who understand how far the digital supply chain extends can better anticipate risks and prevent the next incident from coming as a surprise again.