Officials are still assessing the full impact, but the initial thought is that while serious, it is not as threatening as some previous ransomware attacks. The current attack is not a deep penetration of many Cabinet-level departments, as happened with 2020’s SolarWinds compromise or the theft in 2015 of millions of security clearance records at the Office of Personnel Management. And it won’t stop critical infrastructure from functioning, as happened with the Colonial Pipeline hack in 2021. But some of the stolen data could be used in follow-on attacks, including by impersonating those whose personal information was taken.

Who was behind the attack?

The group behind the attack is known as Cl0p, a hacking organization that has Russian-speaking members and is likely based in Russia. While it would not be a surprise if some members of the group included Russian police or spies, there is no indication that Cl0p takes orders from the Russian government, and its past targeting has been all about money. Analysts believe that the government victims of the hack were caught up in a broad campaign aimed at extracting money from corporations, not at blackmailing government agencies.

How did the hackers get in?

The attackers used a previously unknown or “zero-day” flaw in the MOVEit file-transfer program sold by Progress Software to thousands of clients in the United States and elsewhere. Aimed at handling sensitive data, the program encrypts files and sends them to designated people or groups. Shortly after the attacks began, Progress identified the vulnerability in its software and offered a patch in late May, though not all clients applied it. Attacks through such providers of software or services are especially dangerous because they can hit many customers at once. The good news about this hack is that the flaw permits access only to the database of files being transferred and not the overall networks of the companies or agencies.

What sensitive information was taken and from where?

The known federal victim so far is the U.S. Department of Energy, which oversees nuclear programs. That includes a victimized unit that manages nuclear waste, the Waste Isolation Pilot Plant in New Mexico. It is unclear how often the plant used MOVEit or for what data. Oil giant Shell was hit but said only a small number of employees used the service. The British Broadcasting Corp. and British Airways might have lost sensitive payroll information because of their reliance on a servicing firm called Zellis that used MOVEit. On Friday, Louisiana and Oregon warned that all their driver’s licenses had been exposed, which would include birth dates and home addresses. Louisiana said Social Security numbers and vehicle registration numbers were also at risk. The states recommend that drivers get free credit reports to check for unauthorized activity, freeze their credit to stop new accounts in their name, and get a personal identification number from the IRS to block outsiders from obtaining their tax refunds.

What will Clop do with the data?

The group has begun posting the names of the hundreds of companies it claims to have information from. It says it will start publishing content from those that do not negotiate an extortion payment on June 21. Cl0p said it did not mean to hit governments and that it will delete their data, though it could sell that information to others without anyone realizing it.

Is this a sign that the U.S. can’t defend itself from overseas hacking gangs?

No. The fact that Cl0p felt obliged to declare it wasn’t after the government or hospitals indicates that U.S. arrests and disruptions of some of the most aggressive ransomware gangs are having an impact. The Cybersecurity and Infrastructure Security Agency also moved rapidly to warn potential targets and urge them to apply the protective patches. Ransomware groups still claim new victims daily, and because many attacks go undeclared, it is impossible to know where things are headed. But some indicators , such as the declining average amount of money demanded, show improvement in discouraging such attacks.

Tech Policy

What you should know about the MOVEit ransomware attack

By Joseph Menn

June 16, 2023 at 4:59 p.m. EDT

The BBC was among the victims of the MOVEit hack. (Henry Nicholls/Reuters)

4 min

U.S. officials announced earlier this week that a “small number” of federal agencies had been breached by a ransomware gang known as Cl0p and that they were working to assess the data stolen and mitigate the impact. Here’s what we know about the attack.

Tech is not your friend. We are. Sign up for The Tech Friend newsletter.