What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-10-10 compared with 2023-07-07 · 36 added, 24 removed, 30 unchanged (67% of the section changed)

3 unchanged sentences

If our products contain software defects or security flaws, it could harm our revenues by causing us to lose customers and could increase our liabilities by exposing us to costly governmental investigations or litigation.

For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in government inquiries, a formal law enforcement investigation, and private litigation.

Our products, despite extensive testing and quality control, may contain defects, vulnerabilities or security flaws.

For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in government inquiries, two formal government investigations, and private litigation.

Our products, despite extensive testing and quality control, may, and at times do, contain defects, vulnerabilities or security flaws.

In the ordinary course of business, we may need to issue corrective releases of our software products to fix any defects, vulnerabilities, or security flaws.

1 unchanged sentence

If any such issues are exploited by malicious threat actors, we could experience, among other things, material adverse impact to our revenues due to loss of customers and increased liabilities due to costly governmental investigations or litigation.

In addition, any such matters could affect the ability of our products to work with hardware or other software products, delay the development or release of new products or new versions of products (due to a reallocation of our internal resources), and/or adversely affect market acceptance of our products, all of which could have a material adverse effect on our overall performance.

On the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance.

An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted versions of MOVEit Transfer, known as MOVEit Cloud).

The investigative team determined that the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as (ii) for a small group of customers, in a customer-dedicated cloud instance which is managed separately from the public-cloud).

We promptly took down MOVEit Cloud for further investigation and notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions.

In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud the same day.

For example, we recently released patches for vulnerabilities affecting WS_FTP, one of our file-transfer products that is deployed on-premise in our customers’ environments.

Notwithstanding our efforts to promptly patch such vulnerabilities and encourage customers to deploy the patch as quickly as possible, we do not have telemetry into our WS_FTP customers’ environments or control over their patching activity, and there have been reports of exploitation of these vulnerabilities following the release of our security patches.

We continue to monitor the situation and assess the potential impact of the WS_FTP vulnerabilities on our business, operations, and financial results.

As of August 31, 2023, WS_FTP accounted for less than 1% of our annual gross revenue.

As disclosed via a Form 8-K filed on June 5, 2023, on the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance.

An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted version of MOVEit Transfer known as MOVEit Cloud).

The investigative team determined the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as (ii) for a small group of customers, in customer-dedicated cloud instances that are hosted, separate and apart from the public instances of our MOVEit Cloud platform).

We promptly took down MOVEit Cloud for further investigation and notified all then-known current and former MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions.

In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023, and allowed for the restoration of MOVEit Cloud that same day.

MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance.

However, certain MOVEit Transfer customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their environments and portions of their sensitive customer data.

Furthermore, while we continue to investigate this vulnerability in MOVEit Cloud, we currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances.

For a small group of customers, we provide a dedicated MOVEit Cloud instance which is hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform.

Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to its environment.

As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and another has not revealed the nature of the data that may have been accessed.

As of the date of the filing of this report on Form 10-Q, these events have led to several domestic and foreign government inquiries, one formal investigation from a law enforcement agency, and private litigation, all of which could have adverse impacts on our business and operations and the results thereof.

More specifically, as of the date of the filing of this report on Form 10-Q, (i) four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, and (ii) there have been eleven class action lawsuits filed by

individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers.

We have also been cooperating with inquiries from several domestic and foreign law enforcement agencies and data privacy regulators, as well as one formal investigation from a law enforcement agency.

We currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances.

For a small group of customers, we provide dedicated MOVEit Cloud instances that are hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform.

Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their dedicated MOVEit Cloud environment.

As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and the other has reported that certain personally identifiable information was exfiltrated.

These events have led to several inquiries from domestic and foreign data privacy regulators;

inquiries from several state attorneys general;

formal investigations from:

federal law enforcement agency (as of the date of the filing of this report, the law enforcement investigation that we are cooperating with is not an enforcement action or formal governmental investigation of which we have been told that we are a target), and (ii) the SEC (as further described hereafter);

and private litigation;

all of which could have adverse impacts on our business and operations and the results thereof.

More specifically, as of the date of the filing of this report on Form 10-Q, (i) we have received formal letters from 23 customers and others that claim to have been impacted by the MOVEit Vulnerability, some of which have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, (ii) we have received a letter from an insurer providing notice of a subrogation claim (where the insurer is seeking recovery for all expenses incurred in connection with the MOVEit Vulnerability), and (iii) we are party to 58 class action lawsuits filed by individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers (on October 4, 2023, the Judicial Panel on Multidistrict Litigation issued an order consolidating litigation relating to the MOVEit Vulnerability where we are a party in the United States District Court, District of Massachusetts).

On October 2, 2023, Progress received a subpoena from the SEC seeking various documents and information relating to the MOVEit Vulnerability.

As described in the cover letter accompanying the subpoena, at this stage, the SEC investigation is a fact-finding inquiry, the investigation does not mean that Progress or anyone else has violated federal securities laws, and the investigation does not mean that the SEC has a negative opinion of any person, entity, or security.

Progress intends to cooperate fully with the SEC in its investigation.

Such claims and investigations may have an adverse effect on how we operate our business and our results of operations, and in the future, we may be subject to additional governmental or regulatory investigations, as well as additional litigation or indemnification claims.

Following the discovery of the MOVEit Vulnerability and the various remedial actions described here, we have discovered and patched additional vulnerabilities within the MOVEit Transfer and MOVEit Cloud platforms.

While we are not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors prior to creating patches to address them and making those patches available to our MOVEit Transfer customers and applying those patches to the MOVEit Cloud environments (both the public and dedicated cloud instances) we cannot guarantee that we have or will uncover and/or address all vulnerabilities within the MOVEit platform or any of our other products prior to exploitation.

While we are currently not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors, we cannot guarantee that we have or will uncover and/or address all vulnerabilities within the MOVEit platform or any of our other products prior to exploitation by threat actors.

Our financial liability arising from any of the foregoing will depend on many factors, including the extent to which governmental entities investigate the matter and limitations contained within our customer contracts;

therefore, we are unable at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty.

As the investigation remains ongoing, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Our customers and partners may seek refunds, delay implementation timelines, delay payment, fail to pay us in accordance with the terms of their agreements, or terminate use of our products, all of which can have an adverse affect on us.

As our fact-gathering investigation and litigation response continues, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Also, each of the governmental inquiries and investigations mentioned above could result in adverse judgements, settlements, fines, penalties, or other resolutions, the amount, scope and timing of which could be material, but which we are currently unable to predict.

If customers or partners seek refunds, delay implementation of our products, delay payment, fail to pay us under the terms of our agreements, or terminate use of our products, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our contracts (including litigation related thereto).

For example, as of the date of the filing of this report on Form 10-Q, four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability and it is possible that, in connection therewith, they may delay payment under the terms of their contracts.

For example, as of the date of the filing of this report on Form 10-Q, 23 customers and others that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability and it is possible that, in connection therewith, they may delay payment under the terms of their contracts.

Other MOVEit Transfer and MOVEit Cloud customers have sought refunds or delayed implementation timelines.

5 unchanged sentences

We anticipate that these threats will continue to grow in scope and complexity over time.

For example, once we discovered the MOVEit Vulnerability on May 30, 2023, we (i) promptly took down MOVEit Cloud for investigation, and (ii) notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions.

In parallel, the MOVEit engineering team worked to develop a patch for all supported versions of MOVEit Transfer (and MOVEit Cloud), which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud that same day.

For example, once we discovered the MOVEit Vulnerability on May 30, 2023, we (i) promptly took down MOVEit Cloud for investigation, and (ii) notified all then-known current and former MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions.

In parallel, our team developed a

patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud that same day.

While we believe that our actions have, and will continue to, reduce the likelihood of similar vulnerabilities occurring in the future in our MOVEit product line, malicious threat actors might use techniques to exploit other zero-day vulnerabilities or use other means that we are unable to defend against, in order to compromise and infiltrate our systems, infrastructure, networks, and products, including, but not limited to, MOVEit or other products.

In addition, MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance.

While we devote a significant amount of resources to cyber security related matters in the operation of our business, we may fail to detect the existence of a breach and be unable to prevent unauthorized access to user and company content across our systems, infrastructure, products, and networks.

6 unchanged sentences

Any such failure could result in significant legal and financial exposure, increased costs to defend litigation, indemnity and other contractual obligations, government fines and penalties, damage to our reputation and our brand, and a loss of confidence in the security of our products and services that could potentially have an adverse effect on our business and results of operations.

In addition, our insurance coverage may not be adequate to cover all costs related to cybersecurity incidents or the exploitation of vulnerabilities as well as the disruptions resulting from such events.

In addition, our insurance coverage may not be adequate to cover all costs related to cybersecurity incidents or the exploitation of vulnerabilities as well as the disruptions and liabilities resulting from such events.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors