CCleaner Users’ Data Stolen in MOVEit Attack

In a significant cybersecurity incident, CCleaner, a popular optimization tool, has confirmed a data breach that exposed the personal information of its paid customers. The breach, which occurred in May, was part of the massive MOVEit cyberattack that affected numerous organizations worldwide.

Gen Digital, the multinational software company that owns CCleaner, Avast, NortonLifeLock, and Avira brands, acknowledged the breach in an email sent to customers. The company stated that hackers exploited a vulnerability in the widely used MOVEit file transfer tool, resulting in the theft of names, contact information, and details about purchased products.

According to TechCrunch, Jess Monney, a spokesperson for Gen Digital, confirmed that customer phone numbers, email addresses, and billing addresses were also compromised. In addition, Monney revealed that less than 2% of users were affected but did not provide a specific number. CCleaner claims to have about 65 million paid customers. The delay in disclosing the incident to the affected customers has yet to be explained.

The MOVEit file transfer tool mass-hacking began in May, quickly escalating to become the largest hack of the year by the number of victims. The Clop ransomware group exploited a never-before-seen vulnerability, stealing sensitive data from thousands of organizations. Over 2,500 organizations have confirmed MOVEit-related data breaches since May, affecting at least 66 million individuals. However, the actual number of affected people is likely much higher.

Clop has not yet listed CCleaner on its dark web leak site, the platform it uses to extort companies by threatening to publish their stolen files if ransom demands are not met. However, NortonLifeLock, another Gen Digital brand, was listed on August 14.

In response to the breach, Gen Digital is offering affected users six months of free BreachGuard data breach & loss prevention software, with additional details and steps to be provided in the coming days. Users are advised to reset passwords and remain vigilant.

This incident serves as a stark reminder of the 2017 compromise of CCleaner, where hackers planted malware in the software to spy on over two million users, specifically targeting high-profile tech companies and telecom giants. The recurrence of such incidents raises questions about the company's cybersecurity practices and the need for enhanced security measures to prevent future breaches.