Amazon employee information was stolen in a data breach. The malicious actor behind the breach claims to have stolen 2.8 million lines of data due to the 2023 MOVEit data breach.

Here, security leaders weigh in on this data breach, offering insights on the cause, ramifications and potential preventative measures. 

Security leaders weigh in 

Ferhat Dikbiyik, Chief Research and Intelligence Officer at Black Kite:

Amazon’s recent data breach, traced back to a third-party vendor’s use of the MOVEit tool, is another wake-up call for the supply chain’s hidden vulnerabilities. The MOVEit flaw initially hit hundreds, but the shockwave extended across 2,700+ organizations as the ripple effects reached third and even fourth-party vendors.

We’ve identified over 600 MOVEit servers that were likely caught in this spray attack — leaving a vast field of potential targets. CL0P ransomware, the group exploiting this flaw, named 270 victims within three months, and the count is still rising.

With 200 to 400 organizations speculated to have paid ransoms, the real impact stretches far beyond these numbers. This breach emphasizes that ransomware risk doesn’t stop at your company’s doorstep. In today’s ecosystem, exposure management must extend across the entire supply chain to truly defend against the next big attack."

Joe Silva, CEO at Spektion:  

This update to an older vulnerability exploit reinforces how third-party software remains one of the largest and least manageable cybersecurity risks organizations face, including large and technically sophisticated enterprises. By the time any company reacts to third-party software risks and vulnerabilities, they’re already being actively exploited while just being publicly disclosed. It’s time for a new approach in how we address our software supply chain. 

Rather than lagging behind and simply reacting to CVEs, CISOs and their teams need to focus on a proactive approach to their third-party software by shifting left and leveraging data that enables quick, accurate and actionable risk assessments of software before they’re exploited."  

Nick Mistry, SVP, CISO at Lineaje: 

The breach involving Amazon’s third-party property management vendor is the latest stemming from the MOVEit Transfer incident from 2023. Although the breach is over a year old, its persistent after effects continue to underscore a critical issue for organizations today — the security risks posed by external partners.  

As organizations increasingly rely on third-party vendors for various services, it becomes crucial to ensure these partners meet the same stringent security standards that your own organization upholds. Recent research reveals that an average of 250 components with unknown origins lurk within every application, creating significant points of exposure for the software supply chain. 

This latest incident serves as a reminder that effective third-party risk management should not be a nice-to-have, but a must have. Having a robust incident response plan that zeroes in on third-party threats is essential, so organizations can promptly identify and reduce any risks resulting from vendor partnerships. More specifically, businesses must put in place thorough procedures to proactively detect and address risks, such as frequent security audits, assessments and ongoing third-party software monitoring. 

In today’s threat landscape, the security of your ecosystem extends far beyond the reach of your own systems and infrastructure. Now is the time to reassess your third-party security practices, before the next vulnerability becomes a costly breach and reputational nightmare. As an industry, we need to prioritize ensuring a high level of software integrity throughout the entire software supply chain, end-to-end.