INSIGHTS
Cleo, the second MOVEit: one file transfer product and hundreds of breaches
In December 2024 two vulnerabilities in Cleo's file transfer products were exploited at scale by Clop, with hundreds of claimed victims and confirmations such as Hertz and Chicago Public Schools. The analysis: data theft, insufficient patches, aggregation and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, December 2024 · by cybercoverinsurance
In December 2024 two vulnerabilities in Cleo's file transfer products were exploited on a large scale. The Clop group claimed the attacks, announced dozens of victims at the end of the month and in the following months listed hundreds. Among the companies that later confirmed data theft were Hertz, with about one million people notified, and Chicago Public Schools, with about 700,000.
The case repeats MOVEit, the same group's 2023 campaign, almost to the letter. A single piece of software, present in many companies without being central to any of them, becomes the entry point for data theft at scale. For cyber underwriters, Cleo is the second example of an aggregation scenario that now recurs: many similar claims, in the same period, from one technical cause.
What is known
The vulnerabilities. The first, CVE-2024-50623, affects Cleo Harmony, VLTrader and LexiCom. It had been disclosed in October 2024 and allows unrestricted file upload and download. On 13 December CISA added it to its catalogue of exploited vulnerabilities, noting its use in ransomware attacks. Huntress found that the October fix was not enough, which led to a second flaw, CVE-2024-55956, allowing an unauthenticated user to run commands. Exploitation of both began by 3 December at the latest. On 15 December Shadowserver counted 930 servers still vulnerable, about 720 of them in the US (Cybersecurity Dive).
The claim. On 9 December Huntress reported at least 10 businesses with compromised Cleo servers. Clop then said it was behind the attacks and had kept exploiting the software after the October fix. The group said it did not know the exact number of victims, but described it as "quite a lot" (SC Media). In December it posted obfuscated names of 66 alleged victims, revealed on 14 and 15 January 2025. About 20% of listed victims were in supply chain and logistics, against 2.8% across all ransomware, and about 80% were North American (ZeroFox).
Confirmations. In April 2025 Hertz said customer data had been taken by an actor that exploited Cleo vulnerabilities in October and December 2024. The data included names, contact details, dates of birth, payment cards and driving licences. Hertz said there was no evidence of an impact on its own network (ITPro). Hertz notified 1,000,175 people. Other Cleo-linked confirmations: Chicago Public Schools (700,000 people), Western Alliance Bank (22,000), Champion Home Builders and WK Kellogg. By then Clop had added more than 350 victims to its leak site (Comparitech).
The precedent. The 2023 MOVEit campaign, also by Clop, hit almost 2,800 organisations (SC Media).
What is not known. The total number of companies whose data was actually taken, how many paid and the overall cost of the campaign are not public. Not all of Clop's claims are verified.
A peripheral tool, a central loss
File transfer is not a critical system, but it touches critical data. Cleo, like MOVEit, is used to exchange files with customers, suppliers and partners. It is not the core of the business and often has no senior owner. But the files that pass through it contain personal records, orders, payment data and employee documents.
The loss is theft, not downtime. Clop did not lock victims' systems. It copied data and demanded payment not to publish it. For the policy, the typical claim is not business interruption but a data breach: forensics, notification, support for individuals, legal costs and any third-party claims.
The data is not on the insured's systems, but the insured answers for it. Hertz said its own network was not hit. The data was taken from a file transfer system. For underwriters, the point is that personal data belongs to the insured even when it passes through third-party software, and liability towards individuals stays with the insured.
Fixes that do not fix
The October patch was not enough. CVE-2024-50623 had been fixed in October. Huntress showed the fix could be bypassed, and exploitation continued until a second fix in December (Cybersecurity Dive). A company that had patched promptly could still be exposed.
The questionnaire asks whether you patch, not what is exposed. Patch management questions measure discipline. They do not say which applications can be reached from the internet. For file transfer software, the useful question is whether the server is public, and whether it needs to be. Rapid7 recommended exactly that: removing Cleo products from public internet access (SC Media).
Exposure time matters more than patch time. Between 3 and 15 December hundreds of servers remained vulnerable. For underwriters, the date exploitation began decides which policies are involved and which policy period responds.
Aggregation: the pattern repeats
Two campaigns in less than two years from the same group. MOVEit in 2023, Cleo in 2024. The pattern is the same: an unknown vulnerability in file transfer software, exploited at scale within days, followed by months of claims and notices. Such an event is no longer an exception; it is a loss scenario to model.
The claims tail is long. Victims were revealed in stages: hidden names in December, visible names in January, data published from January, official confirmations until April 2025 and beyond. An affected portfolio sees notices of claim arrive over months, not all at once. A reserve set in January would have been incomplete.
Aggregation concentrates by sector. According to ZeroFox, logistics and supply chain weighed far more than usual among the victims. Software that is widespread in one sector creates sectoral aggregation: an insurer with many logistics operators in its book was more exposed than a diversified one.
Single-event clauses become decisive. Several claims from the same vulnerability may be a single event for reinsurance or deductible aggregation. Wordings that define "event" and "common cause" decide how much the campaign weighs on an insurer's results.
What to bring to renewals
Impact for insurersHigh
A single file transfer product produced hundreds of data breaches within months, repeating the MOVEit pattern.
On the portfolio side, the useful work is knowing how many insureds use the same file transfer software and how many expose it to the internet. The data can be gathered with a questionnaire question or an external scan. With MOVEit and Cleo as precedents, an "MFT" scenario with hundreds of data breach claims in the same quarter is a reasonable basis for testing limits and reinsurance.