AutoZone discloses Clop ransomware attack, impacting 184,995 individuals

AutoZone, a renowned auto parts retailer, revealed on Tuesday that it fell victim to the notorious Clop ransomware gang earlier this year, leading to a significant data breach involving its MOVEit infrastructure. The breach, disclosed in a notification filed with the Office of the Maine Attorney General, affected 184,995 individuals, compromising sensitive personal information, including full names and social security numbers.

This incident transpired in May amidst a series of attacks attributed to Clop, wherein the hackers exploited a vulnerability within the MOVEit file transfer software. According to insights from researchers at Emsisoft, these attacks targeted over 2,000 organizations, impacting approximately 62 million individuals.

AutoZone became aware of the Clop attack in August but only recently determined the extent of data affected. However, it’s worth noting that Clop previously claimed responsibility for an attack on AutoZone in July, disclosing 1.1GB of internal and employee data from the auto retailer, as reported by Bleeping Computer.

In a notification addressed to customers, AutoZone acknowledged a third party’s unauthorized exploitation of a vulnerability associated with the MOVEit application. The specific parts of AutoZone’s systems accessed by the Clop hackers remain undisclosed, although the notification submitted to Maine confirms the leakage of social security numbers. However, AutoZone did not provide detailed specifics on the affected data.