BBC staff have been warned that a vulnerability in a software tool used by a payroll company could be exploited to put personal data in the hands of cybercriminals.
There are a lot of moving parts here, so I’ll give a quick recap here.
BBC – British Broadcasting Company. That employee’s data can be misused by cybercriminals.
IBM – Companies that have subcontracted work to Zellis.
Zelis – The company that managed the BBC’s payroll services via IBM, apparently using a program called MOVEit Transfer.
progress – Developer of MOVEit Transfer, a file transfer tool containing critical vulnerabilities.
Cl0p – A Russian-speaking ransomware extortion group is allegedly involved in the breach.
According to the BBC, Zelis said he had seen no evidence that employee bank account details had been exposed in a data breach.
Even if that’s true, enterprising criminals are turning fraud, identity theft, and even plain There may still be plenty of opportunities for extortion.
Xerris has many other corporate customers, including British Airways and UK high street pharmacy Boots, whose thousands of employees appear to be affected.
It’s important to realize that blaming the BBC, Boots, British Airways, IBM, or even Xerith for this data breach is like shooting Messenger. It’s not really to blame, it’s to shoot the messenger.
Progress, developers of the buggy MOVEit Transfer software, have some apparently difficult questions to answer, and hopefully they’ll release a patch for this problem soon.
But ultimately the real bad guys in this story are the malicious hackers who have exploited their flaws to make a criminal fortune.
Organizations using MOVEit Transfer are wise to read the Progress security bulletin and take the recommended steps to mitigate the threat.
Unfortunately, if data has already been stolen, it is the responsibility of the company to notify affected individuals and companies and report the incident to regulators.
Did you enjoy this article? Follow Graham Cluley on Twitter Or visit Mastodon to read more exclusive content we post.
