The MOVEit Breach Handed Attackers Contact Info for 4.3 Million

HEROIC analysts tracked a large-scale data collection tied to the MOVEit file transfer breach, with this dataset surfacing on May 31, 2024. The exposed records total 4,336,162, containing email addresses, phone numbers, first names, and last names pulled from organizations that used MOVEit for secure file transfers. No passwords were included in this leak.

Why This Is Dangerous

This dataset originated from a critical vulnerability in the MOVEit file transfer software that was exploited to steal data from numerous organizations, and the exposed records were later compiled and publicly released by a threat actor. Because it draws from real business contact records, attackers can use it to send convincing phishing emails that appear to come from a coworker, vendor, or employer, or to call someone directly using their real name and phone number.

What Was Exposed From This MOVEit-Linked Collection

• Email addresses
• Phone numbers
• First names
• Last names

Why This Matters

The MOVEit vulnerability affected file transfer systems used by many companies, which means a collection like this often includes employee and customer contact information from organizations that had no direct security failure of their own, they were simply customers of a vulnerable tool. If your name, email, or phone number is in a collection like this, you become a target for phishing, impersonation scams, and further data aggregation that can eventually lead to account takeover or identity theft.

How Collection Breaches Like This Happen

A collection breach is different from a single company's database dump. It is a compiled dataset that threat actors assemble from one or more original breaches, often reformatting and reorganizing the data to make it easier to search or sell. In this case, records tied to the MOVEit file transfer vulnerability were compiled and released publicly, allowing anyone to search through millions of contact records at once. Because collections aggregate data from multiple sources, they tend to circulate widely and for a long time after the original breach occurred.

Check If You Are Affected

If you have ever interacted with an organization that used MOVEit for file transfers, it is worth checking whether your information is part of this collection. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this incident, and tells you immediately if you have been exposed. Run a free scan today to see where you stand.