FEDERALItem 8.01 · voluntaryHackingTechnologyInformationVulnerability ExploitZero-DayLowActive

Progress Software Corporation

bd_fa21d75a8ae78d4e · schema v1 · pii pii-v1

Severity

Low

Discovered

May 28, 2023

Filed

Jun 5, 2023

To disclose

8 days

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Progress Software Corporation →2 incidents on file

Progress Software Corporation disclosed a zero-day vulnerability in MOVEit Transfer, found after a May 28, 2023 customer report of unusual activity in a MOVEit Transfer instance. Progress determined the vulnerability could provide for unauthorized escalated privileges and access to the customer's underlying environment. It engaged forensic experts, outside counsel and law enforcement, and released a patch on May 31, 2023. The investigation is ongoing; Progress does not expect a material impact.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 days

May 28, 2023

Discovered

Jun 5, 2023

Filed

vs. sector median

17 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_4a79775e8a92d9962023-08-18 · +74dVerified

Name: Progress Software Corporation /MA
norm: progress software corporation ma
SEC CIK: 0000876167

Name: Progress Software Corporation
norm: progress software
SEC CIK: 0000876167
Industry: Technologyllm

Discovered: May 28, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Engaged with federal law enforcement and other federal agencies
Initial access: exploit_public_facing

During the incident: Engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation
Implemented a series of additional security and related measures aimed at addressing this vulnerability and further strengthening the overall security of the MOVEit application
Engaged outside legal counsel to conduct a thorough independent investigation of the vulnerability
Engaged with federal law enforcement and other federal agencies with respect to the vulnerability
Changes made: Developed and released a patch for all supported versions of MOVEit Transfer (including MOVEit Cloud)
Took down MOVEit Cloud for investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

SEC 8-KJun 5 · first · this page

Montana State AG+74d

Pattern: first filing Jun 5, last Aug 18 (MT) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/876167/000087616723000113/
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 5, 2023
Raw hash: fe232e51fa5d84328d04412f914209a05623e10d27d9765bda631df86f35d705

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html37.4 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityProgress Software Corporation /MA

Victim entityProgress Software Corporation

Incidentdiscovered May 28, 2023

Stated responseEngaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing