Legal implications for software developers: MOVEit breach highlights the risks of supply chain vulnerabilities

In the aftermath of the extensive breach involving MOVEit, a 1nationwide class-action lawsuit has been initiated against Progress Software, serving as a potential precedent for further legal action targeting software firms whose vulnerable applications become targets of large-scale supply chain attacks, according to a legal authority.

Progress Software now confronts allegations of negligence and breach of contract, among other claims, as part of five class-action lawsuits spanning the entire nation. These legal actions have been filed by the consumer-rights legal firm Hagens Berman (HBS) subsequent to the exploitation of a crucial zero-day vulnerability by the Cl0p ransomware group within the MOVEit managed file transfer application.

The repercussions of this attack have reverberated across a spectrum of entities. Notably, both high-profile multinational corporations such as Shell Oil and British Airways and smaller public and private organizations that rely on MOVEit for the secure exchange of sensitive data have fallen victim to the breach’s impact.

Within environments where susceptible iterations of the software were deployed, significant amounts of personally identifiable information (PII) belonging to customers were laid bare. This encompassed an array of sensitive data like names, Social Security numbers, birthdates, demographic particulars, insurance policy identifiers, and various financial records. This incident serves as a poignant reminder that software security enhancements are not merely optional but crucial to forestall potential legal consequences.