Amazon confirms employee data stolen after hacker claims MOVEit breach

Date:

Share post:


Amazon has confirmed that employee data was compromised after a “security event” at a third-party vendor.

In a statement given to TechCrunch on Monday, Amazon spokesperson Adam Montgomery confirmed that employee information had been involved in a data breach.

“Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon. The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations,” Montgomery said.

Amazon declined to say how many employees were impacted by the breach. It noted that the unnamed third-party vendor doesn’t have access to sensitive data such as Social Security numbers or financial information and said the vendor had fixed the security vulnerability responsible for the data breach.

The confirmation comes after a threat actor claimed to have published data stolen from Amazon on notorious hacking site BreachForums. The individual claims to have more than 2.8 million lines of data, which they say was stolen during last year’s mass-exploitation of MOVEit Transfer.

The threat actor, operating under the alias “Nam3L3ss” claims to have published data allegedly stolen from 25 major organizations, cybersecurity firm Hudson Rock reports.  

“What you have seen so far is less than .001% of the data I have,” the threat actor claims. “I have 1,000 releases coming never seen before.”

TechCrunch has contacted the other organizations listed by the threat actor but has not yet received any further responses. 

The MOVEit breach, which saw attackers exploit a zero-day vulnerability in Progress Software’s file-transfer software, was the biggest hack of 2023. 

These hacks, which were claimed by the notorious Clop ransomware and extortion gang, impacted more than 1,000 organisations, including the Oregon Department of Transportation (3.5 million records stolen), the Colorado Department of Health Care Policy and Financing (four million) and U.S. government services contracting giant Maximus (11 million).



Source link

Lisa Holden
Lisa Holden
Lisa Holden is a news writer for LinkDaddy News. She writes health, sport, tech, and more. Some of her favorite topics include the latest trends in fitness and wellness, the best ways to use technology to improve your life, and the latest developments in medical research.

Recent posts

Related articles

‘Wolfs’ sequel canceled because director ‘no longer trusted’ Apple

It may be hard to remember, but George Clooney and Brad Pitt co-starred in a movie, “Wolfs,”...

DOJ tells Google to sell Chrome

Welcome back to Week in Review. This week, we’re exploring the DOJ telling Google to sell off...

Tesla says it has reached a ‘conditional’ settlement in Rivian trade secrets lawsuit

Tesla and Rivian may have resolved a lawsuit in which Tesla accused Rivian of poaching employees and...

The rise and fall of the ‘Scattered Spider’ hackers

After evading capture for more than two years following a hacking spree that targeted some of the...

Trump’s tariff threats don’t scare this Mexican fintech

Mexico’s economic development — turbocharged by the amount of nearshoring in recent years — has made it...

Meet three incoming EU lawmakers in charge of key tech policy areas

The European Union looks to have clinched political agreement on the team of 26 commissioners who will...

OpenAI accidentally deleted potential evidence in NY Times copyright lawsuit (updated)

Lawyers for The New York Times and Daily News, which are suing OpenAI for allegedly scraping their...

Sequoia marks up its 2020 fund by 25%

Sequoia says no exits, no problem. The Silicon Valley titan of venture marked up the value of its...