What Happened
In November 2024, a threat actor known as Nam3L3ss publicly released 2.8 million lines of Amazon employee data on BreachForums, stemming from a breach of a third-party property management vendor that managed employee contact information; the incident originated from exploitation of a zero-day vulnerability (CVE-2023-34362) in the MOVEit file transfer software, first targeted by the Cl0p ransomware group in May 2023. The exposed data included names, work email addresses, desk phone numbers, building locations, cost center codes, and organizational details, but no sensitive personal information such as Social Security numbers, financial data, passwords, or customer records was compromised, with Amazon confirming its internal systems and AWS remained secure. Amazon spokesperson Adam Montgomery stated the breach was limited to the vendor, and the company notified affected employees while collaborating to patch the vulnerability, highlighting ongoing risks from third-party supply chain weaknesses amid an attack wave impacting nearly 3,000 organizations and 96 million records.
