Clop Ransomware Group Exploits MOVEit Vulnerability, Targets Major Law Firms and Corporations A ransomware attack linked to the Clop cybercrime group has compromised several high-profile organizations, including law firms Kirkland & Ellis, Proskauer Rose, and K&L Gates, as well as entities like Ofcom, EY, PwC, Shell, and Aon. The breach stemmed from a critical SQL injection vulnerability in MOVEit Transfer, a third-party file-transfer software exploited by a hacker operating under the alias "Lance Tempest" a suspected affiliate of Clop. The attack began in late May, when Clop infiltrated MOVEit’s systems. Though the vendor released a patch shortly after, many organizations failed to apply it in time, leaving them exposed. Clop initially gave victims until June 14 to negotiate via a dark web portal, warning that non-compliance would result in public exposure of their identities. When the deadline passed, the group published the names of over 100 affected organizations, signaling their refusal or inability to engage. Unlike typical ransomware operations, Clop does not disclose fixed ransom amounts upfront. Instead, victims are directed to contact the group via email before negotiations shift to an encrypted chat on its dark web site. If no agreement is reached within three days, Clop threatens to release stolen data within a week. Cybersecurity firm Cypfer reports that the group’s demands often start at $3 million. Believed to be Russian-linked, Clop has drawn heightened scrutiny from authorities, with the U.S. government offering a $10 million bounty for information leading to the arrest of its leader. Meanwhile, the targeted law firms have not disclosed details about the compromised data, ransom demands, or their response strategies. The incident underscores the persistent threat of supply-chain attacks, particularly against law firms frequent targets due to their handling of sensitive client information. Earlier this year, a separate case involving a junior solicitor highlighted internal security risks, as she sued a firm over alleged unauthorized access to her private WhatsApp messages.

A MOVEit attack on the business service provider Aon resulted in the personal data of 3000 staff at the Dublin Airport being compromised. An unauthenticated attacker might use the SQL injection vulnerability to access MOVEit Transfer's database without authorization. DAA has stated that it is helping the affected employees, however, Aon has not yet made a public statement regarding the security issue.

Aon, the global insurance and reinsurance broker was recently targeted in a cyber-attack. The attack hit a limited number of its systems and didn't had a significant impact on its operations.

The Washington Attorney General's Office reported a data breach involving Aon Corporation PLC on May 26, 2022. The breach, which began on December 29, 2020, was due to unauthorized access and affected 6,889 individuals in Washington, compromising names, Social Security numbers, and driver's license numbers.

On May 26, 2022, the California Office of the Attorney General reported that Aon PLC experienced a cyber incident impacting certain systems, which occurred between December 29, 2020, and February 26, 2022. The breach potentially compromised personal information including names, Social Security numbers, and driver's license numbers, although it is stated that there is no evidence of misuse of personal information.