Amazon confirms employee data stolen after hacker claims MOVEit breach

Amazon has confirmed that employee data was compromised after a “security event” at a third-party vendor.

In a statement given to TechCrunch on Monday, Amazon spokesperson Adam Montgomery confirmed that employee information had been involved in a data breach.

“Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon. The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations,” Montgomery said.

Amazon declined to say how many employees were impacted by the breach. It noted that the unnamed third-party vendor doesn’t have access to sensitive data such as Social Security numbers or financial information and said the vendor had fixed the security vulnerability responsible for the data breach.

The confirmation comes after a threat actor claimed to have published data stolen from Amazon on notorious hacking site BreachForums. The individual claims to have more than 2.8 million lines of data, which they say was stolen during last year’s mass-exploitation of MOVEit Transfer.

The threat actor, operating under the alias “Nam3L3ss” claims to have published data allegedly stolen from 25 major organizations, cybersecurity firm Hudson Rock reports.  

“What you have seen so far is less than .001% of the data I have,” the threat actor claims. “I have 1,000 releases coming never seen before.”

TechCrunch has contacted the other organizations listed by the threat actor but has not yet received any further responses. 

The MOVEit breach, which saw attackers exploit a zero-day vulnerability in Progress Software’s file-transfer software, was the biggest hack of 2023. 

These hacks, which were claimed by the notorious Clop ransomware and extortion gang, impacted more than 1,000 organisations, including the Oregon Department of Transportation (3.5 million records stolen), the Colorado Department of Health Care Policy and Financing (four million) and U.S. government services contracting giant Maximus (11 million).

Subscribe for the industry’s biggest tech news