Amazon confirmed in November 2024 that employee work contact information was affected by a security incident at an unnamed third-party property-management vendor. Amazon said its own and AWS systems remained secure. A hacker’s separate claims—more than 2.8 million data lines and information tied to 25 organizations—were not an Amazon-confirmed count or independently established for every organization.
Was Amazon hacked in the MOVEit breach?
Amazon said the incident occurred at a property-management vendor that served multiple customers, including Amazon—not in Amazon’s or AWS’s own systems. The vendor’s identity was not disclosed in the contemporaneous report.
Amazon spokesperson Adam Montgomery told TechCrunch on November 11, 2024: “Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon. The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations.” TechCrunch’s report also said the vendor had fixed the vulnerability.
So, Amazon confirmed employee information was involved in a vendor-side security event, while saying its own systems had not experienced a security event. That distinction does not establish that the vendor incident posed no risk; it describes the scope of Amazon’s public statement.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What Amazon employee information was involved?
Amazon identified work email addresses, desk phone numbers, and building locations. It said the vendor did not have access to sensitive information such as Social Security numbers or financial information. Amazon did not disclose how many employees were affected.
What did the hacker claim, and what is confirmed?
| Statement | Who said it | What it establishes |
|---|---|---|
| Employee work emails, desk phone numbers, and building locations were involved in the vendor incident | Amazon, through spokesperson Adam Montgomery | Amazon’s stated categories of affected employee information; no employee count was given. |
| More than 2.8 million lines | Threat actor using the alias Nam3L3ss, as reported by TechCrunch in November 2024 | The actor’s claimed volume. “Lines” should not be treated as unique people, Amazon records, or an Amazon-confirmed employee count. |
| Data from 25 organizations | Nam3L3ss, as reported by TechCrunch | The actor’s claim about organizations. TechCrunch said the other organizations it contacted had not responded by publication; the report does not establish that each later confirmed exposure. |
The actor’s numbers and broader claims are separate from Amazon’s description of the employee information involved. The available report does not settle what data, if any, each other named organization later confirmed was affected.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How does the incident relate to the 2023 MOVEit attacks?
The dates matter: the MOVEit exploitation campaign began in 2023; the actor’s claimed publication and Amazon’s confirmation were reported in November 2024. The November 2024 report was not describing a newly discovered 2024 MOVEit exploit.
Progress Software’s 2023 Form 10-K says the company received a customer support call about unusual activity on May 28, discovered the zero-day vulnerability on May 30, and released a patch for supported MOVEit Transfer and MOVEit Cloud versions on May 31. The filing also says on-premises MOVEit Transfer did not provide Progress with ongoing telemetry about customer usage, file transfers, or patch status, so Progress could not centrally determine each customer’s exposure from its own telemetry. Progress’s SEC filing describes that response.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
CISA and partner agencies describe the 2023 attack as exploitation of CVE-2023-34362, a SQL injection flaw used to install the LEMURLOOT web shell on MOVEit Transfer web applications and steal files. CISA’s advisory explains the vulnerability and campaign. The available Amazon statement identifies a property-management vendor incident but does not publicly identify the vendor or detail the technical path linking it to the MOVEit campaign.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How large was the wider MOVEit impact?
Other organizations reported substantial impacts during 2023, but those figures describe their own disclosures, not Amazon’s incident:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Maximus said in a July 26, 2023 SEC filing that its preliminary estimate was 8 million to 11 million individuals whose personal information was in affected files; it said the estimate could change. Maximus’s filing provides the estimate.
- Apple reported figures of at least 2,300 organizations and more than 65 million individuals affected by MOVEit as of October 2023, based on sources cited in its analysis. These are Apple’s dated figures, not a current total. Apple’s analysis gives its methodology and source references.
These measures count different things—individuals, organizations, or, in the actor’s claim, data lines—and come from different speakers and dates. They should not be added together or substituted for an Amazon employee count.
What should employees do?
The public statement describes work contact details, not Social Security numbers or financial information. Employees who receive unexpected messages that reference their work location, role, or contact details should verify the sender through a known internal channel before sharing information, opening attachments, or following links. For questions about an individual’s exposure or any required action, use the employer’s official security or HR communications; the public report does not provide a named-vendor contact or employee-by-employee notification details.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
