Amazon confirms data breach, employees' phone numbers and other information exposed

Amazon

In a major data breach, Amazon employees’ email addresses and phone numbers were leaked. According to a report by cybercrime company Hudson Rock, the stolen data — dates back to May 2023 — included employee information from more than 25 major companies. Apart from Amazon, some of the big names include Lenovo, HP, Delta Airlines, HSBC. The leaked employee information includes names, email IDs, phone numbers, and for some their entire organisational structures.

A hacker known as Nam3L3ss released sensitive data obtained through a critical vulnerability in MOVEit, a widely-used file transfer software. This vulnerability, labelled CVE-2023–34362, has led to one of the most significant corporate data breaches of last year.

First identified in mid-2023, the MOVEit vulnerability exposed a critical flaw in the software, allowing attackers to bypass authentication and access secure data repositories. This exploit enabled cybercriminals to infiltrate multiple systems and exfiltrate confidential information, including employee and customer data.

What does Amazon have to say?

In a statement given to The Verge, Amazon spokesperson Adam Montgomery said the company was informed about a “security event at one of our property management vendors that impacted several of its customers, including Amazon.”

He further said that employees’ social security details or any financial data wasn’t part of the leak. He also emphasised that Amazon’s systems remain secure and the company as such didn’t “experience” a security event. “The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations,” he said.

The hacker, as per Hudson Rock, shared the files on a cybercrime forum. He also made a public post warning companies and individuals to pay attention to the sheer size of the leaks and information available.