Amazon Confirms Employee Data Breach Through Third-Party Vendor

Amazon confirmed that employee data was exposed due to a breach at a third-party vendor, which exploited a critical vulnerability in MOVEit file transfer software.

The CVE-2023-34362 vulnerability, first reported in mid-2023, caused a massive data breach, affecting multiple global companies.

A hacker named Nam3L3ss posted the stolen employee data, with Amazon being the most impacted.

The breach exposed over 2.8 million Amazon employee records, marking it as one of the largest data leaks of its kind. Other major companies, such as HSBC, MetLife, and Cardinal Health, were also impacted.

The vulnerability in MOVEit, discovered in May 2023, allowed attackers to bypass authentication processes and access sensitive data being transferred through the software. This flaw enabled unauthorized parties to intercept and steal information, leading to a widespread breach across various industries.

Despite security patches being released, the delay in applying them left organizations vulnerable to attacks. Cybercriminals quickly exploited the MOVEit flaw, causing several high-profile data breaches.

The stolen data includes employee details like names, emails, phone numbers, job roles, and cost center information. These datasets, organized by company, have appeared on underground forums, increasing the risk of further cyberattacks like phishing, social engineering, and identity theft.

The Infostealers report reveals that the leaked data includes detailed employee records from 25 major companies. The breach is vast, with millions of compromised records. Here’s a breakdown of some affected companies and the number of exposed records:

The stolen Amazon data includes sensitive employee details like names, email addresses, phone numbers, and organizational roles, creating a major risk for targeted phishing and corporate espionage. HSBC’s compromised dataset similarly exposes employee information across various countries and divisions.

A leaked snippet of data from Amazon reveals entries for over 2.5 million employees. The hacker, Nam3L3ss, publicly warned companies about the breach, stressing the significance of exposed internal structures. The breach presents several risks:

• Phishing & Social Engineering: Detailed contact info enables targeted phishing attacks.
• Corporate Espionage: Internal structures could be exploited for competitive advantage.
• Reputational Damage: High-profile firms like Amazon and HSBC face lasting harm to their reputation.
• Financial Fraud: Exposed data increases the risk of financial theft, especially for companies in finance and healthcare, like Cardinal Health and UBS.

Amazon is working with cybersecurity experts to assess the breach and strengthen its security. However, the full impact may become clearer as the stolen data spreads in cybercriminal forums.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!