Amazon confirms employee data theft following hacker's claim about MOVEit breach.

Amazon has confirmed that a data leak involving employees occurred following a "security incident" related to an external vendor. In a statement issued, Amazon spokesperson Adam Montgomery indicated that employee information was affected by a data breach. Montgomery stated, "Amazon and AWS systems remain secure, and we have not faced a security event. We were notified of a security incident at one of our property management vendors that affected several of their clients, including Amazon. The only information from Amazon involved was employees' work contact information, such as professional email addresses, desk phone numbers, and building locations."

Amazon did not disclose how many employees were affected by this breach. Furthermore, it emphasized that the external vendor did not have access to sensitive data such as Social Security numbers or financial information, and assured that the vendor had already addressed the security vulnerability that led to the data leak.

This confirmation came after a threat actor claimed to have published stolen information from Amazon on a well-known hacking site. This individual claims to possess over 2.8 million lines of data, which he says were taken during the widespread exploitation of MOVEit Transfer software last year. Under the alias "Nam3L3ss," the actor claims to have published data allegedly stolen from 25 major organizations, according to cybersecurity firm Hudson Rock. "What you have seen so far is less than 0.001% of the data I have," the actor stated, adding that he has "1,000 leaks that have never been seen before."

Authorities have been contacted to comment on the other organizations mentioned by the actor, but no additional responses have been received yet. The breach related to MOVEit, where attackers exploited a previously unknown vulnerability in Progress Software's file transfer software, is considered the largest hack of 2023. These attacks have been attributed to the infamous Clop ransomware group and affected over 1,000 organizations, including the Oregon Department of Transportation (with 3.5 million records stolen), the Colorado Department of Health Care Policy and Financing (four million), and Maximus, a giant U.S. government services contractor (11 million).