The MOVEit Breach, One Year Later: What It Changed About Vendor Risk
A single zero-day in a widely-used file-transfer product cascaded into one of the largest data-exposure events on record, purely through vendor concentration.
The 2023 MOVEit Transfer breach — exploited via a SQL injection zero-day by the Cl0p ransomware group — didn't compromise thousands of organizations directly. It compromised one widely-used managed file-transfer product, and the exposure cascaded through every organization (and every organization's vendors, and their vendors) that relied on it.
The vendor-risk lesson that actually generalizes
Traditional vendor risk assessment asks "is this vendor secure," evaluated roughly once a year. MOVEit-style cascades expose a different question vendor-risk programs are generally worse at answering: "how concentrated is our exposure to a single product, and what's our actual blast radius if that specific product has a zero-day tomorrow?"
- Maintain a real inventory of which vendors' products handle sensitive data flows, not just which vendors have signed a security questionnaire.
- Track concentration risk — how many critical processes run through a single third-party product.
- Build an incident-response playbook for "our vendor was breached," not just "we were breached" — the notification and remediation mechanics are genuinely different.