Amazon has confirmed that a security incident affecting a third-party vendor has exposed employee information.
The incident saw data allegedly belonging to employees at a host of major tech firms leaked, with the data believed to have been stolen during the 2023 MOVEit breach.
An Amazon spokesperson told ITPro its internal systems remain secure, insisting the incident was isolated to one of its third-party property management systems.
“Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon.”
The statement added that the published information was limited to employee contact information, as well as some location data.
“The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations.”
Amazon did not confirm how many employees were impacted by the breach.
The tech giant isn’t the only major organization impacted in the data dump. HP, Lenovo, and other parties including HSBC and MetLife have allegedly been impacted in the breach.
ITPro has contacted the organizations for confirmation.
Leaked by a cyber criminal using the moniker ‘Nam3L3ss’, the cache is said to include a variety of employee data including names, email addresses, phone numbers, cost center codes, and, in some cases, entire organizational structures of the affected parties.
Nam3L3ss claims to have over 2.8 million records stolen from Amazon in particular, as well as half a million taken from life insurance company MetLife.
The total number of records published in the initial release was nearly five million lines of data, affecting 25 large organizations.
RELATED WHITEPAPER
Nam3L3ss claimed that what they have released so far is less than 0.001% of the data they have in their possession, alleging they have 1,000 releases coming with data that has never been seen before.
The threat actor, who claims not to be a hacker, said the information was taken during the May 2023 MOVEit attacks.
Hackers affiliated with the Cl0p threat collective exploited a zero-day vulnerability in Progress’s MOVEit file transfer protocol, used by thousands of large organizations around the world.
The vulnerability, tracked as CVE-2023-34362, was an SQL injection flaw identified in the MOVEit Transfer web application that was leveraged by the threat actors to gain access to MOVEit Tranfer’s database.
-
Should AI PCs be part of your next hardware refresh?AI PCs are fast becoming a business staple and a surefire way to future-proof your business
-
Westcon-Comstor and Vectra AI launch brace of new channel initiativesNews Westcon-Comstor and Vectra AI have announced the launch of two new channel growth initiatives focused on the managed security service provider (MSSP) space and AWS Marketplace.
-
Forget MFA fatigue, attackers are exploiting ‘click tolerance’ to trick users into infecting themselves with malwareNews Threat actors are exploiting users’ familiarity with verification tests to trick them into loading malware onto their systems, new research has warned.
-
Hackers are turning Amazon S3 bucket encryption against customers in new ransomware campaign – and they’ve already claimed two victimsNews Attackers are using AWS’ server-side encryption to conduct ransomware attacks
-
Nearly 70 software vendors sign up to CISA’s cyber resilience programNews Major software manufacturers pledge to a voluntary framework aimed at boosting cyber resilience of customers across the US
-
Three channel partner considerations for tackling ransomwareIndustry Insight Channel partners can play a vital role in protecting customers from the growing threat of ransomware, but there's no one-size-fits-all approach
-
Amazon Detective offers security analysts their own generative AI sidekickNews The AI assistant for Amazon Detective will supercharge security operations and incident response, according to AWS
-
Amazon's Ring agrees to $5.8m settlement over alleged use of its cameras to spy on female customersThe firm will also pay $25m for allegations Alexa stored child voice recordings indefinitely
-
Lenovo patches ThinkPad, Yoga, IdeaPad UEFI secure boot vulnerabilityNews Mistakenly used drivers could allow hackers to modify the secure boot process
-
Numerous HP business laptops and desktops vulnerable to publicly disclosed security bugsNews Researchers revealed the details of the six vulnerabilities at Black Hat in August but many laptops, desktops, and workstations remain vulnerable
