In late May 2023, Cl0P ransomware group began exploiting a zero-day vulnerability in Progress Software’s MOVEit file transfer platform. By early June, the story had crystallized into something terrifying: 2,700 organizations across every sector you can imagine, from health care to financial services to federal agencies, had been breached. Over 93 million individuals’ data was exposed. The vulnerability, CVE-2023-34362, became the second-largest breach by victim count in recent years, trailing only the earlier SolarWinds supply chain attack in terms of sheer scope.

This is not a story about a single company’s security failure. It’s a story about what happens when you build critical business infrastructure around a single piece of commercial software that nobody audits, nobody fully understands, and nobody has bargained for the risk. And if you’re thinking about moving into security, or if you’re already working in information security, this breach is a map of where the next five years of your career opportunities are going to be.

The Technical Setup

MOVEit is what’s called a managed file transfer platform. If your organization needs to send sensitive files to partners, clients, or other internal teams, and you need auditing, encryption, and compliance tracking built in, MOVEit is the kind of tool you buy. It’s not glamorous infrastructure, it’s not on your network diagram in the way firewalls and access points are, but it’s absolutely critical. Your healthcare provider uses it. Your bank uses it. Your government uses it. If you have PII or payment card data that needs to move from point A to point B with a record of who touched it and when, MOVEit has probably touched it at some point.

The vulnerability worked this way: MOVEit has a web interface where authorized users can log in and manage file transfers. That interface was vulnerable to SQL injection, which meant an attacker could craft a specially formed request and execute arbitrary SQL commands on the database running behind the application. From there, it was straightforward. Extract the session tokens that the application uses to identify authenticated users, and you can impersonate whoever you want. Extract the database keys, and you can decrypt files that were supposedly protected. Once you’re inside, you can download whatever files are sitting in there waiting to be transferred.

The really alarming part was that there wasn’t much surface area for detection. If you weren’t specifically looking for SQL injection attempts in your web application logs, you might not see this attack at all. The attacker could slip in, grab data, and vanish without triggering the kind of alert fatigue that security teams have learned to expect from their monitoring tools.

Why This Breach Exposes a Real Problem

We’ve talked before about supply chain security after SolarWinds, but MOVEit illustrates a different angle on the same fundamental problem. SolarWinds was about attackers compromising software at the source, poisoning the update mechanism. MOVEit is about attackers finding a vulnerability in critical software that thousands of organizations depend on, and then systematically walking through the customer list extracting data. Both are supply chain problems, but they require different defensive strategies.

The core issue is that MOVEit customers are not in a position to audit the software they’re running. Progress Software publishes MOVEit, maintains it, patches it, and controls the source code. If there’s a vulnerability in the application, the customers find out about it when Progress discloses it. Until that moment, the vulnerability just sits there. The attacker who finds it first wins. Everyone else loses.

This creates an asymmetry that no amount of traditional network security can fully solve. You can have excellent firewall rules, network segmentation, endpoint protection, threat detection, the whole security stack, and you’ll still be vulnerable to a zero-day in the business-critical software that you depend on to operate. The vulnerability lives inside the software itself, at a layer below most organizations’ detection capabilities.

And the Cl0P group, which has a sophisticated operational methodology, systematically went through the victim list, prioritizing health care organizations, government agencies, and financial services firms. They published victim lists, demanded ransoms, and in many cases, the victims had little choice but to pay because their data was out there and there was no getting it back.

What This Means for Security Careers

Here’s why you should care about MOVEit if you’re thinking about building a security career: this breach created immediate, urgent demand for entire categories of security skills that are still growing.

Third-party risk management became essential overnight for thousands of organizations. Before MOVEit, a lot of companies had a spreadsheet somewhere that listed their critical software vendors, and someone in IT security probably reviewed it once a year. After MOVEit, organizations realized they needed a more sophisticated approach. They needed to know what versions of what software were running where, they needed vulnerability tracking for those applications, they needed incident response plans for when vendors released security patches, and they needed to understand the blast radius if one of their critical suppliers got compromised. If you can build expertise in vendor risk management, software asset management, or vulnerability tracking, you’re now in a space where every organization is scrambling to figure out what they’re doing.

Incident response and breach investigation became specialized skills that organizations are willing to pay for aggressively. When Cl0P hit a healthcare organization, that organization couldn’t wait around for a slow internal investigation. They needed to know immediately what data was taken, whether it exposed patient records, what notification obligations they had, and what the financial exposure was. Breach investigation requires specific technical skills: database forensics, log analysis, understanding how the attack path through the application actually worked. Organizations are hiring incident response teams and breach forensics specialists specifically to handle this, and they’re paying well because the alternative is legal liability, regulatory fines, and loss of customer trust.

Managed file transfer security and application-specific hardening became a specialty area. MOVEit is just one application, but the principle applies to dozens of others. Your organization probably has other critical applications running that have vulnerability surfaces you haven’t fully mapped. Database management systems, collaboration platforms, CRM tools, custom applications written in-house that nobody has security expertise about anymore. If you can develop deep expertise in securing these applications, if you understand the attack vectors specific to your industry and your toolset, you have genuine bargaining power. This is not about generic security knowledge; this is about knowing how to protect the specific applications your industry depends on.

Database security and encryption became visible in a way they hadn’t been before. One of the things that made MOVEit so dangerous is that once the attacker had database access, they could potentially decrypt files that were supposed to be encrypted. This raised a simple question that a lot of organizations hadn’t thought deeply about: how good is our encryption strategy? Are we encrypting in a way that would still protect data even if the database was compromised? This is a specialized area of expertise. Cryptography is harder than most people think, and implementing encryption in a way that’s both secure and practical requires real knowledge. Organizations are now looking for people who can help them answer these questions.

The Ongoing Demand

What’s important to understand is that this isn’t a one-time crisis that will blow over. Organizations are going to be dealing with MOVEit fallout and with their own versions of this scenario for years. They’ll be conducting forensics, they’ll be updating their vendor management processes, they’ll be implementing new controls, they’ll be dealing with regulatory questions about why they got breached and what they’re doing to prevent it next time.

You can also see the parallel to the security skills shortage more broadly. There aren’t enough security professionals to go around. There aren’t enough incident responders, not enough threat hunters, not enough people who understand supply chain risk, not enough database forensics specialists. Organizations know they’re understaffed, and they’re willing to hire and train people who show aptitude, even if they don’t have every credential in place yet.

The Reality for Your Career

Here’s the hard part of building a security career right now: you can’t just be a generalist. The breadth of security knowledge is too wide, and organizations are looking for people with real depth in specific areas. You need to pick a direction. Do you want to get good at understanding how attackers operate and how to find them in your network? That’s threat hunting and incident response. Do you want to understand how software gets built and how to make that process more secure? That’s secure software development and application security. Do you want to understand how organizations should think about vendor relationships and third-party risk? That’s supply chain and vendor risk management.

The MOVEit breach is loud evidence that all of these specializations matter. It’s not theoretical. Organizations are spending real money right now to build capabilities in these areas, and they’re looking for people who have or can develop expertise. The entry barrier is still knowledge and experience, but the economic incentive for you to acquire that expertise just got significantly clearer.

The other thing to recognize is that this breach is going to accelerate conversations about security that were already happening but maybe not at high enough priority. Organizations were already thinking about zero trust, but MOVEit made it urgent. They were already thinking about application security, but now they have a concrete reason to fund it. If you can position yourself as someone who understands not just the problem but the solutions and the implementation path, you’re going to be valuable to organizations trying to move forward.

The breach didn’t happen because anyone was malicious or reckless. It happened because Progress Software had a zero-day, and the Cl0P group found it and exploited it, and most organizations didn’t have the defensive infrastructure in place to catch it quickly. That’s a structural problem in how software is developed, distributed, and operated. Solving that problem is going to require skilled, knowledgeable people. If you’re thinking about moving into security, or if you’re already in security and thinking about where to specialize, the MOVEit breach is telling you exactly where the need is greatest.

The work is real, the demand is real, and the career path is real. This is your moment to pick a specialty and develop expertise in it.