Procter and Gamble Disclose Data Breach

Procter & Gamble (P&G) is the latest of many companies to disclose that they were affected by a vulnerability in Fortra’s GoAnywhere file-sharing solution. This resulted in a breach in early February that exposed the personal information of an unknown number of its employees.

In a statement given to BleepingComputer, "P&G can confirm that it was one of the many companies affected by Fortra's GoAnywhere incident. As part of this incident, an unauthorized third party obtained some information about P&G employees."

P&G has confirmed that the attackers did not gain access to employees' financial or social security information, but they did manage to steal some of their other personal data.

"When we learned of this incident in early February, we promptly investigated the nature and scope of the issue, disabled [the] use of the vendor's services, and notified employees," P&G said.

P&G also reassured customers that there was no indication that any customer data was affected by the issues and that "business operations are continuing as normal."

The company did not disclose exactly what information was stolen or the identity of those responsible for the security breach. However, this incident is linked to a series of extortion demands from the Clop ransomware gang, who claimed responsibility for exploiting the relevant zero-day vulnerability in the GoAnywhere tool. They have been publicly extorting affected companies since March 10th.

The vulnerability allowed the attackers to achieve remote code execution on unpatched GoAnywhere MFT systems that had their administrative console exposed to the internet. Clop exploited the CVE-2023-0669 GoAnywhere vulnerability and stole data of more than 130 organizations, or so they claim.

In ransom notes sent to victims, the ransomware gang identifies themselves as the "Clop hacker group" and warns that they have stolen sensitive documents. The group threatens to publish the information on Clop's leak site and sell it on the black market if the victims refuse to negotiate.

Clop has been active since 2019 and reportedly amassed around $500 million in extortion payouts by November 2021. Although the group halted its activities for a time due to multiple arrests, it has since re-emerged.

So far, the list of victims who have acknowledged GoAnywhere breaches and have been extorted by Clop include Community Health Systems (CHS), Hatch Bank, and Rubrik.