CL0P ransomware gang exploited a zero-day SQL injection in Progress Software’s MOVEit Transfer MFT product starting May 27 2023. Installed LEMURLOOT web shell to steal data. Over 2,700 organizations and ~93 million individuals affected globally. Major victims: Maximus (8-11M records), Louisiana OMV (6M), Colorado HCPF (4M), Oregon DOT (3.5M), BBC, British Airways, Aer Lingus, University of Rochester. Patches released May 31 2023 but exploitation preceded patch.