The MOVEit campaign was not a curiosity. It was a textbook demonstration of how a single, internet‑facing managed file transfer product can cascade into a multi‑sector crisis. A SQL injection zero day in MOVEit Transfer, tracked as CVE‑2023‑34362, was exploited to install a web shell known as LEMURLOOT, often disguised as human2.aspx, and used to steal files from underlying databases. This exploitation was rapid, wide, and attributable to the CL0P/TA505 cluster.

Utilities should treat the MOVEit story as a playbook for what to harden first. The most immediate lesson is that third and fourth parties matter. Several utilities learned their customer and usage data were exposed not because their own networks were breached but because a vendor they used for program administration was compromised. Vendors that perform billing, incentive program administration, or field reporting present an attack surface equal to their access rights. Contracts and security reviews that stop at checkbox audits are insufficient. Insist on active telemetry, forensic cooperation clauses, and the right to validation scans when you rely on a vendor for operational data or program delivery.

Architectural containment wins. Managed file transfer servers that are internet‑facing and have direct access to databases or cloud storage are high value targets. Utilities must assume any internet‑exposed MFT could be exploited and enforce strict segmentation. That means isolating MFT systems from core IT and OT networks, restricting what accounts the MFT system can access, and using firewalls to limit access to known management IPs only. If you cannot immediately patch, take the service offline or block HTTP and HTTPS to the appliance until mitigations are in place. Progress and multiple incident responders advised emergency patching and, where immediate patching was impossible, temporary isolation as a stopgap.

Detection and hunting need to be tuned to the unique indicators of these attacks. The LEMURLOOT web shell used custom HTTP headers and created artifacts such as human2.aspx in the MOVEit wwwroot folder, and it could enumerate Azure Blob storage and the MOVEit database. Hunt for unexpected files in MFT web roots, anomalous downloads from blob storage, new administrative accounts with names like Health Check Service, and large outbound transfers originating from MFT instances. Retain and review application logs and web server logs for the relevant May 2023 timeframe or any period since you first deployed an MFT. CISA and responders published specific detection recommendations and queries that should be integrated into monitoring and EDR playbooks.

Patching and layered compensations matter. Progress issued emergency fixes beginning May 31, 2023 and then followed with additional patches in June. Patching alone is necessary but not sufficient. Apply vendor patches promptly. Then add compensating controls: block access at the perimeter, enforce least privilege for service accounts, require MFA for administrative access, and put MFT backups on isolated storage that is not writable by the MFT application. Also maintain an allow list and limit scripting and compilation capabilities on servers that host internet‑facing applications.

Assume exfiltration and plan notification. The MOVEit compromises led to data exposures spanning multiple sectors and millions of individuals. For utilities that rely on third parties, assume that any data passed through an affected MFT could have been copied. That means immediately scoping what specific fields and records were shared, where they reside, and which customers or contracts are affected. Prepare regulatory notifications, customer outreach templates, and credit monitoring offers if PII was exposed. Document the timeline and your response steps. Public agencies and incident responders expect timely cooperation.

Operational technology considerations. The MOVEit breach mainly targeted an IT service. But the path from IT to OT exists when MFT systems are given access or when vendor credentials are reused across environments. Utilities must enforce strict credential separation between IT and OT, implement multi‑factor authentication for vendor access, and treat remote vendor access as a high risk activity that requires jump hosts, session recording, and just‑in‑time privileges. Regularly review where vendor accounts can touch OT systems and eliminate any direct or indirect paths.

Test the whole chain with incident drills that include third parties. Tabletop exercises that only cover your internal operators miss the hard part. Run scenarios where a critical vendor reports a compromise of a shared MFT and require your teams to identify impacted customers, cut lateral paths, coordinate legal and PR responses, and restore services using isolated backups. Include questions about data minimization, retention, and whether sensitive files should ever transit vendor MFT systems in plaintext. After‑action findings should be folded back into procurement, architecture, and contracting.

Final takeaways. The MOVEit campaign shows how a single widely deployed product can become a force multiplier for data theft. For utilities the risk is twofold. First, operational continuity can be threatened when vendor relationships give outsiders indirect access. Second, customer trust and regulatory exposure escalate when customer PII or usage data is lost. Address both problems with three priorities: enforce aggressive segmentation and isolation, treat third and fourth parties as part of your attack surface and contract accordingly, and bake realistic detection and response for MFT‑class applications into your security program. Do those three things and you reduce the likelihood that the next widely exploited zero day produces the same downstream damage.