Amazon has confirmed a data breach involving employee information due to a third-party vendor’s vulnerability, which exposed contact details like work email addresses, desk phone numbers, and building locations.

Amazon attributed the breach to the widely exploited vulnerability in the MOVEit file transfer software, developed by Progress Software. Amazon reassured customers that its internal systems, including Amazon Web Services (AWS), remained uncompromised.

The company’s spokesperson, Adam Montgomery, clarified that the breach stemmed from a vendor issue rather than a direct security failure at Amazon. In a statement, he said: “Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon.”

Montgomery emphasised that the only data involved was employee work contact information, not sensitive data such as Social Security numbers or financial records.

“The only Amazon information involved was employee work contact information,” Montgomery said, “for example, work email addresses, desk phone numbers, and building locations.”

The MOVEit exploit, dating back to May 2023, capitalized on a zero-day SQL injection vulnerability that the Clop ransomware group and other threat actors used to gain access to sensitive data across many organisations. The flaw in MOVEit’s managed file transfer tool created widespread risks, as it allowed hackers to bypass authentication measures, gaining unauthorised access to data transfers and storage.

A threat actor known as “Nam3L3ss” has since claimed responsibility for the Amazon breach, stating on a hacker forum that they possess over 250TB of data, covering information from Amazon and 25 other organisations, including other prominent entities like IBM, Deloitte, and HSBC. Nam3L3ss also threatened further releases of data, warning companies to “pay attention” to cybersecurity lapses.

Recommended reading

• UK Gov: Data Centres Are Now Critical National Infrastructure
• AWS Commits Over £180 Million to GenAI Startups
• New Survey Reveals UK T&L Has “Significant” Data and AI Gap

This incident marks another chapter in the ongoing saga of MOVEit data breaches, which has plagued organisations across industries, from tech giants to government agencies. Reports by Forbes highlight that Nam3L3ss’s posting is likely just a small fraction of the stolen data, with more than 1,000 organisations reportedly affected by MOVEit breaches to date.

In response to the incident, Amazon has urged continued vigilance around third-party software vulnerabilities and reaffirmed that its systems remain secure, with ongoing efforts to work closely with the impacted vendor to prevent future issues.

However, this latest breach shows that despite the initial MOVEit vulnerability being discovered and patched in 2023, organisations continue to face consequences from this security incident, demonstrating the devastating long-tail of supply chain compromises.