BA, BBC and Boots caught up in file transfer hack

Reuters

Published Jun 05, 2023 14:19

Updated Jun 06, 2023 00:13

LONDON (Reuters) - Tens of thousands of employees of British Airways (LON:ICAG), the UK drugstore chain Boots and Britain's BBC were among those whose personal data was exposed following a wide-ranging breach centred on a popular file transfer tool, the organizations confirmed on Monday.

BA, the BBC and Boots said the breach occurred at their payroll provider, Zellis. The provincial government of Nova Scotia, in Canada, was also hit.

The data from Zellis and the Nova Scotia government was exposed through their use of the MOVEit file transfer software, both organizations said in separate statements. Zellis declined to say how many customers were affected.

The Nova Scotia government did not immediately return a request for comment. In a statement, Nova Scotia's cyber security and digital solutions minister, Colton LeBlanc, said his residents "will have questions, and we do, too."

British Airways, owned by IAG, said it had notified affected employees and was providing them with support. Boots, part of Walgreens Boots Alliance (NASDAQ:WBA), said the attack had included some of its employees' personal details. The BBC said it was working with Zellis "as they urgently investigate the extent of the breach."

MOVEit has been at the centre of security industry concerns after its maker, Massachusetts-based Progress Software, disclosed a flaw last week that could have allowed hackers to intercept data being exchanged through the program.

In a statement on Monday, MOVEit said it had fixed the vulnerability exploited by the hackers and was working with experts to investigate the issue "and ensure we take all appropriate response measures."

Microsoft (NASDAQ:MSFT) on Sunday said it believed the group behind the hacks was "Lace Tempest" - the nickname assigned to online extortionists who run the cl0p ransomware site.