Texas-based credit union says MOVEit Transfer breach impacted 102k customers

Austin, Texas-based financial services provider University Federal Credit Union suffered a significant data breach as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.

In a notice of data breach filed with the Office of the Maine Attorney General, University Federal Credit Union (UFCU) said that it used Progress Software’s MOVEit Transfer web application to send and receive files securely and was impacted after cyber criminals exploited a zero-day vulnerability in the application to access its users’ data.

After being notified by Progress Software, the manufacturer of MOVEit software, UFCU said it immediately applied the security patches released by the company. UFCU also launched an internal investigation with assistance from third party cyber security experts to understand the scope of the incident.

“As part of that investigation, we learned that some UFCU files have been copied and removed from the MOVEit platform by an unauthorised party. We discovered on September 15, 2023, that the files potentially contained some of your personal information,” the credit union said.

The compromised data includes UFCU’s clients’ names and other personal identifiers along with their financial account numbers, credit and debit card numbers in combination with security codes, access codes, passwords and PIN for the accounts. The filing with the regulator also confirms that at least 102,650 individuals have been affected by the cyber security incident.
 
While the credit union said that it has “NO evidence that any of your information has been used to commit financial fraud”, the possibility of the same cannot be ruled out. It has urged all affected individuals to remain vigilant and place a fraud alert and security freeze on their credit files.

The credit union is also offering a year of complimentary credit monitoring and identity theft protection services through Experian to all individuals impacted due to the data breach.

Almost 2,300 organisations worldwide have so far suffered significant data breaches as a result of the Clop ransomware group exploiting vulnerabilities in Progress Software’s MOVEit Transfer web application.

According to German cybersecurity research firm KonBriefing, as of October 11, at least 2,274 organisations have come forward about security incidents resulting from the exploitation of the software and at least 67.4 million individuals have been impacted by the same.