AutoZone warns almost 185,000 customers of a data breach
MOVEit attacks have affected over 62 million people so far.
AutoZone alerted authorities on Tuesday that it had been a victim of the Clop ransomware gang's MOVEit attacks earlier this year. According to a breach notification filed with the Office of the Maine Attorney General, the data leak from the auto parts retailer impacted 184,995 people. The hackers acquired personal information, including full names and social security numbers, the notification said.
The incident happened in May, as a part of a string of attacks linked to Clop. The hackers exploited a vulnerability in file transfer software MOVEit, attacking more then 2,000 organizations and impacting 62 million people, according to researchers at Emsisoft.
AutoZone realized it had fallen victim to the Clop attack in August, but it didn't suss out what data had been affected by the attack until earlier this month. That said, Clop claimed responsibility for an attack on AutoZone in July, publishing 1.1GB of internal and employee data from the auto retailer, according to Bleeping Computer.
"AutoZone became aware that an unauthorized third party exploited a vulnerability associated with MOVEit and exfiltrated certain data from an AutoZone system that supports the MOVEit application," AutoZone wrote in a notification to customers. It's unclear which parts of the AutoZone systems the Clop hackers accessed and, although the Maine notification says social security numbers had been leaked, AutoZone did not provide any specifics.
AutoZone rakes in $17.5 billion in revenue each year, operating more than 7,000 retail locations.
