Saturday, March 2, 2024

MOVEit Hack : Over 185,000 AutoZone Users Personal Data Hacked

AutoZone Inc., a US retailer of automotive parts and accessories, warned customers that their data had been compromised as a result of the Clop MOVEit file transfer attacks.

Personal information, such as the names and social security numbers of 185,000 individuals, was impacted due to the extensive MOVEit hacking campaign.

Founded in 1979, AutoZone, Inc. is the largest retailer in the United States, with 7,140 locations around the country as well as in Mexico, Puerto Rico, Brazil, and the US Virgin Islands.

Overview of the Data Breach

According to the company’s breach notification, more precisely, AutoZone discovered that certain data had been exfiltrated as a result of the MOVEit application’s vulnerability being exploited on or around August 15, 2023.

An unauthorized third party had taken advantage of a MOVEit vulnerability and was able to exfiltrate some data from a system that AutoZone maintains and uses to support the MOVEit application.

Document
Free Webinar

Live API Attack Simulation Webinar

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

The vulnerability in the MOVEit Transfer program affected over two thousand companies worldwide, as has been widely publicized.

AutoZone took action to evaluate and fix the issue as soon as they learned about the incident. In particular, the company launched an inquiry and hired independent specialists.

“We  began an investigation to understand the scope and impact. We also took measures to address the vulnerability, including temporarily disabling the MOVEit application, rebuilding the affected system, and patching the vulnerability. We have no evidence at this time that the incident is ongoing”, reads the notification.

The MOVEit software vulnerability, identified as CVE-2023-34362, was exploited by the Cl0p ransomware group to steal data from numerous enterprises that were utilizing the program for file transfers.

The vulnerability impacted the US Department of Energy, Siemens Energy, Schneider Electric, Shell, hundreds of US schools, and the state of Maine.

Hence, the business advised customers to be on the lookout for identity theft and fraud. Additionally, avoid opening attachments or clicking links in shady emails, and exercise caution when you receive unsolicited communications requesting personal information from you or directing you to a website that provides.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Website

Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles