Amazon has confirmed that some data was breached during the spate of MOVEit software exploits that started during May, 2023. The MOVEit cyber attacks hit several large organizations, including the BBC, British Airways, Shell and several government agencies, as hackers targeted a critical SQL injection vulnerability, CVE-2023-34362, in the software. But as the new breaks, more than a year on, that Amazon data was breached, customers are now wanting to know if their accounts are safe and whether passwords should be changed.
Amazon Has Not Experienced A Security Event, A Spokesperson Said
A statement released by Amazon spokesperson Adam Montgomery on Nov. 11, has clarified the nature of the data breach and denied that Amazon or Amazon Web Services had “experienced a security incident.” The MOVEit exploit impacted an unnamed third-party property management vendor that includes Amazon as one of its customers. “We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon,” the Amazon spokesperson, Adam Montgomery, said.
Reporting at forbes.com, contributor Lars Daniel said the breach was carried out by a threat actor going by the name of Nam3L3ss, oh the irony. They recently posted data from 25 organizations, including Amazon, and warned there is an archive in excess of 250TB that includes “entire databases from exposed web sources including mysql, postgres, SQL Server databases and backups, azure databases and backups etc.”
Were Amazon Customer Accounts And Passwords Compromised During The Cyber Attack?
The good news is that there would appear to be no impact upon customer accounts or credentials. “The only Amazon information involved was employee work contact information,” Montgomery said, “for example, work email addresses, desk phone numbers, and building locations.”
The bad news is that third-party supplier security continues to be in the hacker crosshairs. “This update to an older vulnerability exploit reinforces how third-party software remains one of the largest and least manageable cybersecurity risks organizations face,” Joe Silva, CEO at cybersecurity vendor Spektion, said, “including large and technically sophisticated enterprises.”
Therefore, Amazon customers do not need to change their passwords or check their credit cards for signs of fraud.
Read the full article here
