BA, BBC and Boots caught up in file transfer hack

LONDON, June 5 (Reuters) – Tens of thousands of employees at British Airways, UK pharmacy chain Boots and Britain’s BBC were among those whose personal data was exposed following a massive breach centered on a popular file transfer tool, the organizations confirmed on Monday.

BA, BBC and Boots said the breach occurred at their payroll provider, Zellis. The provincial government of Nova Scotia, in Canada, was also affected.

The data from Zellis and the Nova Scotia government was exposed through their use of MOVEit file transfer software, both organizations said in separate statements. Zellis declined to say how many customers were affected.

The Nova Scotia government did not immediately return a request for comment. In a statement, Nova Scotia’s Cyber ​​Security and Digital Solutions Minister Colton LeBlanc said his citizens “will have questions, and so do we.”

British Airways, owned by IAG ( ICAG.L ), said it had notified affected staff and was providing them with support. Boots, part of Walgreens Boots Alliance ( WBA.O ), said the attack had included some of its employees’ personal details. The BBC said it was working with Zellis “as it urgently investigates the extent of the breach”.

MOVEit has been at the center of security industry concerns after its maker, Massachusetts-based Progress Software ( PRGS.O ), disclosed a flaw last week that could have allowed hackers to intercept data exchanged through the program.

In a statement on Monday, MOVEit said it had fixed the vulnerability exploited by the hackers and was working with experts to investigate the issue “and ensure we are taking all appropriate response measures.”

Microsoft ( MSFT.O ) said on Sunday it believed the group behind the hacks was “Lace Tempest” — the nickname given to online extortionists who run the cl0p ransomware website.

In an email to Reuters, the “cl0p team” confirmed it was responsible for the breaches, saying “it was our attack” and that victims who refused to pay would be named on their website. The group did not immediately respond to a request for more details.

Boots employs over 50,000 people in the UK. British Airways has around 30,000 employees, and the BBC has more than 21,000 employees.

Reporting by Raphael Satter in Washington, Sarah Young and Muvija M in London and Eva Mathews in Bengaluru; additional reporting by Kanishka Singh; Editing by Paul Sandle, Bill Berkrot and Leslie Adler

Our standards: Thomson Reuters Trust Principles.