MOVEit Data Transfer Breach

[Admin/YBB]

MOVEit Data Transfer Breach

MOVEit data transfer is used institutionally & they found that it had a hackable access/trap door that some bad people used to access data being transferred. This breach has affected many firms (including TIAA), banks, brokers, several government organizations (including Social Security), but I haven't heard anything from anyone else, only from PBI on behalf of TIAA.

We got letters from PBI (with ID numbers) about the TIAA breach & we both signed up with Kroll for 2 years of free credit monitoring. Signup requires providing DOB, Social Security number, etc & answering a short Q&A based on some personal credit history - the most common answer was N/A but not for all.

Kroll is the old Duff & Phelps. The old Duff & Phelps bought Kroll & renamed the whole thing Kroll. So, it is a very old company that you may not have heard of (1932- ).

Curiously, we haven't heard from anyone else.

en.wikipedia.org/wiki/2023_MOVEit_data_breach
securityintelligence.com/news/the-moveit-breach-impact-and-fallout-how-can-you-respond/
www.pionline.com/courts/retired-teacher-sues-tiaa-over-moveit-data-breach
www.healthcaredive.com/news/612K-Medicare-beneficiaries-affected-MoveIt-data-breach/689346/

[Admin/YBB]

Update - Massachusetts District Court to Handle MOVEit Lawsuits

By now there are 101+ lawsuits related to the MOVEit data transfer breech in several states. A US judicial panel on multidistrict litigations (MDL) has considered 2 broad issues:

1. Should only the MA District Court consider MOVEit related lawsuits? The answer to that is YES; see the related order below (10/4/23).

2. Should all MOVEit related lawsuits be consolidated into one? Or, be coordinated as multiple lawsuits? There are pros and cons for either. Specifically, the TIAA & others are opposing consolidation; Progress Software (MOVEit is its product) & some other favors consolidation. This issue is still PENDING - to be decided later by the MA District Court.


The judicial panel on multidistrict litigations (MDL) has ruled (10/4/23):

"We are persuaded that the District of Massachusetts is the appropriate transferee district for these cases. More cases are pending in this district than in any other district, and the owner of the MOVEit file transfer software, Progress Software Corp., is headquartered in Burlington, Massachusetts. Relevant employees likely are based in this district, where potentially relevant databases, documents, witnesses, and other evidence also may be found. We are confident that Judge Allison D. Burroughs will steer this litigation on a prudent course to resolution.


IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the District of Massachusetts are transferred to the District of Massachusetts and, with the consent of that court, assigned to the Honorable Allison D. Burroughs for coordinated or consolidated proceedings with the actions pending there and listed on Schedule A."

Think Advisor - News  www.thinkadvisor.com/2023/10/10/moveit-breach-suits-against-genworth-tiaa-and-others-head-to-boston/
US Court Order, 10/4/23  www.jpml.uscourts.gov/sites/jpml/files/MDL-3083-Transfer_Order-9-23.pdf
Progress Software - Wiki  en.wikipedia.org/wiki/MOVEit