(Bloomberg) -- About a week ago, the US Cybersecurity and Infrastructure Security Agency and the FBI sent out a joint advisory warning that a file-transfer product called MOVEit contained a dangerous flaw, one that could allow hackers to steal data from affected systems.

Most Read from Bloomberg

It turned out the problem hit close to home. On Thursday, the agency — called CISA for short — provided an update: The very same flaw in MOVEit had been used to breach several US agencies.

CISA Director Jen Easterly said the agency is providing support to departments affected by the MOVEit attack. She said that “as far as we know” the hackers are only stealing information stored on the MOVEit service, and that the intrusions weren’t being leveraged to gain further access to other parts of networks.

CISA’s announcement was the latest confirmation of what many feared when the first MOVEit-related breaches were disclosed earlier this month — that it could turn into a hacking spree. Though Easterly didn’t name the affected agencies, a contractor at a US national lab and a radioactive waste storage site managed by the Department of Energy were among the victims, according to a person familiar with the matter.

“Upon learning that records from two DOE entities were compromised in the global cyberattack on the file-sharing software MOVEit transfer, DOE took immediate steps to prevent further exposure to the vulnerability,” an agency spokesperson said.

The list of victims includes Shell Plc, the government of Nova Scotia, the UK communications regulator Ofcom, the Minnesota Department of Education, and the Dutch campsite and recreation company Landal GreenParks.

IAG SA’s British Airways, the pharmacy chain Boots and the British Broadcasting Corp. told staff that personal information may have been compromised after a breach of their payroll provider, Zellis.