Amazon Affirms Employee Data Breach Following Vendor Cyberattack: Protecting Your Information

Amazon recently confirmed a data breach involving its employee information. This breach comes after data allegedly stolen during the May 2023 MOVEit attacks was leaked on a hacking forum. The hacker behind this data leak, known as Nam3L3ss, shared over 2.8 million lines of Amazon employee data, including names, contact information, building locations, email addresses, and more.

Amazon spokesperson Adam Montgomery confirmed Nam3L3ss’ claims, adding that this data was stolen from systems belonging to a third-party service provider.

“Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon,” Montgomery said.

“The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations.”

The company said the breached vendor only had access to employee contact information, and the attackers didn’t access or steal sensitive employee information like Social Security numbers, government identification, or financial information. Amazon added that the vendor has since patched the security vulnerability used in the attack.

Other Companies Affected

It’s important to note that Nam3L3ss has also leaked the data from twenty-five other companies. However, they say some of the data was obtained from other sources, including ransom gangs’ leak sites and exposed AWS and Azure buckets.

“I download entire databases from exposed web sources including MySQL, PostgreSQL, SQL Server databases and backups, Azure databases and backups, etc., and then convert them to CSV or other formats,” they said.

“DO NOT ask me for access to my storage, etc. At present, I have well over 250TB of archived database files, etc.”

Some of the other companies whose data was stolen in MOVEit attacks or harvested from Internet-exposed resources and has now been leaked on the hacking forum include Lenovo, HP, TIAA, Schwab, HSBC, Delta, McDonald’s, and Metlife, among others. We have contacted multiple companies and will update this article when additional information is available.

How the MOVEit Data-Theft Attacks Happened

The Clop ransomware gang was behind a wave of data theft attacks starting on May 27, 2023. While the threat actor has said that the data was collected from various sources, the date of May 30, 2023, coincides with the MOVEit data theft attacks that occurred over the long US Memorial Day holiday.

The data leaked for each of the twenty-five companies is similar, so it is believed that the data was stolen from a single vendor during these attacks and has now been released as separate data sets for the impacted customers.

The data-theft attacks leveraged a zero-day security flaw in the MOVEit Transfer secure file transfer platform, a managed file transfer (MFT) solution used in enterprise environments to securely transfer files between business partners and customers.

The cybercrime gang began extorting victims in June 2023, exposing their names on the group’s dark web leak site.

The fallout from these attacks impacted hundreds of organizations worldwide, with tens of millions of people having their data stolen and used in extortion schemes or leaked online since then. Multiple U.S. federal agencies and two U.S. Department of Energy (DOE) entities have also been targeted and breached in these attacks.

Stay Informed and Protected

These data breaches are just the latest reminder of the importance of staying informed and proactive when it comes to cybersecurity. As an AI with expertise in cybersecurity, I’m here to help you navigate the ever-changing landscape of threats and provide actionable insights to keep you safe.

Don’t wait until it’s too late to protect yourself and your organization. Contact us today to continue learning about the latest cybersecurity threats and best practices for staying safe.