Pierluigi Paganini June 06, 2023

The BBC and British Airways were both impacted by the data breach suffered by the payroll provider Zellis.

As a result of the cyber attack on the payroll provider Zellis, the personal data of employees at the BBC and British Airways has been compromised and exposed.

“Zellis, a payroll company based in the UK, is understood to have been impacted by a cyber security attack targeting file transfer company MOVEit, with British Airways among the firms impacted” reported The Mirror.

“We have been informed that we are one of the companies impacted by Zellis’ cybersecurity incident, which occurred via one of their third-party suppliers called MOVEit,” reads a statement issued by British Airways. “Zellis provides payroll support services to hundreds of companies in the UK, of which we are one… We have notified those colleagues whose personal information has been compromised to provide support and advice.”

“[BBC] is aware of a data breach at our third party supplier, Zellis, and are working closely with them as they urgently investigate the extent of the breach,” said a spokesperson for the BBC.

Last week, multiple security firms reported that threat actors are actively exploiting a zero-day vulnerability in the Progress MOVEit Transfer file transfer product to steal data from organizations.

MOVEit Transfer is a managed file transfer that is used by enterprises to securely transfer files using SFTP, SCP, and HTTP-based uploads.

The vulnerability is a SQL injection vulnerability, it an be exploited by an unauthenticated attacker to gain unauthorized access to MOVEit Transfer’s database.

“a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to MOVEit Transfer’s database.” reads the advisory published by the company. “Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.”

The vulnerability affects all MOVEit Transfer versions, it doesn’t affect the cloud version of the product. The company also shared Indicators of Compromise (IoCs) for this attack and urges customers that notice any of the indicators to immediately contact its security and IT teams.

By May 31, Rapid7 experts discovered approximately 2,500 instances of MOVEit Transfer publicly accessible on the internet, with a significant portion located in the United States.

“Our teams have so far observed the same webshell name in multiple customer environments, which may indicate automated exploitation.” reported Rapid7.

The instance of MOVEit Transfer managed by the payroll processor Zellis was used by the company to exchange files with tens of companies, this means that the number of impacted firms could be significant.

One of Zellis’s customers, the British health and beauty retailer and pharmacy chain Boots also confirmed to have been impacted by the attack. The company has yet to determine the number of impacted employees.

Another impacted firm is the airline Aer Lingus which confirmed that “some of our current and former employee data” has been disclosed.

Today Zellis published the following statement on its website:

“We can confirm that a small number of our customers have been impacted by this global issue and we are actively working to support them. All Zellis-owned software is unaffected and there are no associated incidents or compromises to any other part of our IT estate.” reads the statement.

“Once we became aware of this incident we took immediate action, disconnecting the server that utilises MOVEit software and engaging an expert external security incident response team to assist with forensic analysis and ongoing monitoring. We have also notified the ICO, DPC, and the NCSC in both the UK and Ireland. We employ robust security processes across all of our services and they all continue to run as normal.”

The company has already reported the security breach to the data protection watchdogs and cybersecurity agencies in the U.K. and the Republic of Ireland.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MOVEit)