The division of Sony Group behind the PlayStation video consoles and games is the latest American-based organization to publicly acknowledge being victimized by the zero-day vulnerability in Progress Software’s MOVEit file transfer platform.
Sony Interactive Entertainment (SIE) has begun notifying almost 6,800 former employees and family members of current or former staff that their personal data was stolen from the company’s MOVEit system by a hacker at the end of May.
A copy of the letter being sent to affected people and filed with the Maine attorney general’s office has blanked out what personal information was copied. However, the filing notice says the information includes peoples’ name or other personal identifier and their Social Security numbers.
On May 28, before Progress Software announced the vulnerability, a threat actor used the vulnerability to download some SIE files stored on its MOVEit platform, the letter to victims says. SIE discovered the hack on June 2, after which the division took down and remediated the server and notified police.
The Clop/Cl0p ransomware gang has taken credit for discovering and exploiting the vulnerability.
Sony Group is headquartered in Tokyo, but SIE is headquartered in California.
As of today, researchers at Emsisoft estimate that 2,342 organizations around the world have publicly said data on tens of millions of customers, employees, or former employees was directly or indirectly (through their data processors) stolen in MOVEit hacks. That includes over 4 million people whose data was kept by the Colorado Department of Health Care Policy and Financing and 3.4 million mothers and children in Ontario whose data was kept by a registry of newborns.
Experts say that if your organization uses MOVEit, the IT department should assume its server has been hacked.
In the past two years, vulnerabilities in file transfer applications from IBM, Accellion and Fortra have been targeted by Clop/Cl0p and other attackers. And Progress Software’s other file transfer application, WS_FTP, was recently added to the list.