Owners of MOVEit to Blame for ‘Massive’ Cyberattack in May 2023, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims the operators of data transfer service MOVEit failed to protect the personal information of millions of individuals during a “major international cyber-attack” that reportedly began in May 2023.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 21-page lawsuit says that beginning on May 27, an unauthorized third party gained access to the defendants’ MOVEit transfer servers by exploiting a “critical” vulnerability in the platform’s software. Per the suit, notorious ransomware gang Clop is reportedly responsible for the “massive” cyberattack on the MOVEit platform, which has resulted in “widespread disclosures of data breaches domestically and worldwide, impacting various companies, federal government agencies, and local state agencies.”

The case names as defendants IT software development company Ipswitch, Inc. and its owner, Progress Software Corporation, who together sell MOVEit, a leading data transfer platform used to send large files. According to the complaint, the private information compromised in the breach included, without limitation, individuals’ names, email addresses, phone numbers, home addresses, dates of birth, Social Security numbers, driver’s license information, tax records and bank account information.

Related Reading: 2023 MOVEit Data Breach Lawsuits

Though the list of MOVEit customers that were affected by the ransomware attack continues to increase, the case relays that those which have announced potential or confirmed impact include, without limitation:

• Louisiana Office of Motor Vehicles;
• Oregon Department of Motor Vehicles;
• Oak Ridge Associated Universities (U.S. Department of Energy);
• Waste Isolation Pilot Plant (U.S. Department of Energy);
• Umpqua Bank;
• UnitedHealthcare Student Resources;
• Leggett & Platt;
• University System of Georgia;
• 1st Source;
• First National Bankers Bank;
• Putnam Investments;
• Datasite;
• National Student Clearinghouse; and
• Gen Digital.

As the lawsuit tells it, the cyberattack is a result of the defendants’ failure to perform sufficient testing for software weaknesses like the one reportedly used by the hackers to access the network.

“Had [the defendants] adequately tested MOVEit for security flaws and vulnerabilities, and undertaken industry best practices and steps to protect and secure MOVEit, they could have prevented the Data Breach,” the suit charges.

According to the case, the consequences of the cyberattack have already started to emerge, as stolen information is reportedly being posted on Clop’s data leak website along with ransom demands from the group.

The complaint says that the plaintiff, a Louisiana resident, had his personal information unlawfully exposed when cybercriminals targeted records belonging to the Louisiana Office of Motor Vehicles as part of the MOVEit data breach. Like other victims, the plaintiff now faces a “substantially increased risk” of identity theft and fraud, the filing shares.

The lawsuit looks to represent anyone in the United States whose personal information was compromised in the MOVEit data breach, including those who were sent a notice of the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.