Evidence-based cyber and vendor risk intelligence: all-source, real-time, full-cycle.
- Who ran the breached system?
- Whose data was exposed?
- Who else is at risk?
- Who paid?
Deliver actionable briefs to your clients faster. BreachGraph traces each answer to its source and adjusts confidence as new evidence arrives. Use private workspaces to monitor watchlists and set alerts, adjust sources and confidence models, add your own evidence and assertions, test hypotheses and predictions, and detect anomalies.
Founding Analyst pilots start in November: reviewed custody reports on any vendor you name, from $149. Request a sample report
Early accessPatent Pending
Breached serverPBI24,520,067The largest of 171 breached-system custodians.Check the filingHide the filing
- PBI ran the MOVEit server. Its notice to the Maryland Attorney General says it applied the available patch “as a user of that software.” Confidence: high.
- 24,520,067 is BreachGraph’s reconciled total for PBI across 48 clients and vendors, with identified overlapping notices counted once.
Sources
Its clientMilliman1,342,303One of 48 clients and vendors whose data PBI held.Check the filingHide the filing
- Milliman Solutions told the New Hampshire Attorney General that it sent its clients’ consumer data to PBI, and that PBI stored it on servers running MOVEit Transfer.
- 1,342,303 is the sum of Milliman’s three filings with the Maine Attorney General: 1,280,823, 56,457 and 5,023.
Sources
Their clientsMEMBERS Life · CMFG Life · Foresters1,280,823Also Trane 5,023, and 56,457 not yet split among Milliman’s other clients.Check the filingHide the filing
- The same New Hampshire notice names MEMBERS Life Insurance Company, CMFG Life Insurance Company and The Independent Order of Foresters as the clients whose consumers were affected.
- 1,280,823 is Milliman’s Maine filing of 17 Jul 2023. The filings give no split by insurer, so the three share one figure.
Sources
Connected organizations178 more Milliman clientsIncluding Acuity Brands Lighting, AECOM, Aflac and AGFA. Counts not yet allocated to each client.Check the filingHide the filing
- Milliman’s Maryland notice lists the clients whose data it handled; most of these 178 links come from that list.
- Milliman’s filings don’t allocate a count to each client, so these organizations are linked to the breach without a number.
Sources
MOVEit proved the model.
BreachGraph's answers for the 2023 campaign, as of 21 October 2026. “Real-time” describes collection: every source is checked on a schedule, and nothing changes a published count until it has been reviewed. What we watch, and how often
-
Who ran the breached system?
171
organizations that ran a breached MOVEit server, each rated moderate confidence or higher on BreachGraph’s 21 October custodian list. The largest, PBI, accounts for 24,520,067 reported exposures.
BreachGraph’s 21 October census counts 1,877 organizations in all: these 171 plus 1,718 data owners and intermediaries whose data reached a breached server they didn’t run, less 12 that played both roles. It is not yet a count of unique companies: 334 are still being matched to a legal entity. How the census counts
-
Whose data was exposed?
115,986,845
reported exposures, reconciled by custody path, with identified duplicate and overlapping counts removed. Each one links to its source. By BreachGraph’s classification, at least 73.5% belonged to organizations other than the one running the server, and at least 52.6% was health data reported to HHS under HIPAA. How these shares are calculated
-
Who paid?
9 of 10
class settlements so far are with the custodian that ran the breached server, not the data owner. The costs land there too: Maximus alone has recognized $35.2M in MOVEit incident charges since 2023. And 233 lawsuits are still pending in the federal MOVEit case.
Read the MOVEit litigation brief: what the court orders, settlements and regulator findings show about who answers for a vendor’s breach.
In use
Five ways to put it to work
From a campaign's first leak-site names to the courtroom.
The clips replay the work on real filings. During the pilot, we run it for you and send reviewed reports; self-serve workspaces are planned for early 2027. See the pilot
-
01Monitor emerging threats
Follow a new campaign as it unfolds, with every name weighed against its evidence
Replayed from Cl0p's 2026 PTC Windchill campaign: CISA listed the flaw as known-exploited on 25 June, extortion emails surfaced on 20 July, and 42 masked names were first seen on the leak site on 5 August, until Cl0p began revealing them on 12 August. BreachGraph rated each name against what the organization itself had disclosed: Philips at High, Fiserv as a claim only.
Replay of the 2026 campaign: BreachGraph’s leak-site collector started on 14 September, after these names were posted. Postings now arrive a median of 10 minutes after RansomLook lists them (measured weekly). Sources: PTC and CISA advisories, Ransom-ISAC reporting, Philips' disclosure, BreachGraph leak-site capture. Watchlist illustrative.
-
02Urgent impact report
Turn a new filing into a sourced client brief
A Maryland notice says PBI used MOVEit while processing data for NTT DATA on behalf of Standard Insurance. BreachGraph matches it to your client, lays out the custody path from The Standard through NTT DATA to PBI, separates what the evidence confirms from what is still open, and drafts the brief for your review.
Replay of a 24 Aug 2023 filing. Sources: Maryland AG notices ITU-373215 and ITU-372461, Maine AG filing. Clients illustrative.
-
03Portfolio triage
Find every client that reached a breached provider, even through another vendor
Check PBI against eight clients: four reached it, three of them only through another vendor. Routes that are inferred rather than stated in a filing are marked, with the reasoning one click away, so you know what each brief rests on.
Sources: Maryland, Maine, Indiana and Oregon AG filings. Portfolio illustrative.
-
04Vendor diligence
Check a vendor's breach record before you sign or renew
BreachGraph connects 1.69 million reported exposures across 13 FIS client populations to their source evidence. It also finds FIS in a second role, passing client data to PBI's MOVEit server (139,834 exposures, inferred), and turns both into questions to put to the vendor.
Sources: regulator filings, BreachGraph leak-site capture, Buckler exposure lists. Vendor list illustrative.
-
05Follow the aftermath
Follow a breach into court, regulators and settlements
Three years on, MOVEit is still producing consequences. Of 10 class settlements, 9 are with the custodian that ran the breached server; the tenth is with a data owner whose vendor ran it. In MOVEit so far, liability has followed custody, and BreachGraph tracks both.
Sources: MDL 3083 orders and filings, settlement administrators, NYDFS, JPML docket report of 1 Oct 2026.
Founding Analysts
Pilots start in November
Name the vendors and clients you need to investigate. We send back reviewed custody reports: who ran the breached system, whose data passed through it, and the filing behind each step.
-
1 · Book a scoping call$49
We review every request by hand, then offer a 30-minute call to agree what you need and when. The $49 stays refundable until we agree on scope, and then counts toward your first report.
-
2 · Choose a reportFixed price
- Vendor custody report, $149. One vendor, any breach or campaign: who ran the breached system, every population on it, the route each took, and the filing behind every step.
- Client exposure check, $299. Up to 25 of your clients or vendors, checked against the breaches you name, with the route each exposure took.
Reports arrive within two working days of agreeing scope, and weekly updates on the companies you name are included while your pilot runs. Request a sample report
-
3 · Then, self-serve$49 a month
Your own private workspace on BreachGraph’s evidence, planned for early 2027 at a Founding Analyst price. See the roadmap and the pilot terms.
BreachGraph is built for defenders. Access is licensed to vetted professionals doing defensive work, with limits on how much can be viewed or exported.
Sources
What we watch, and how often
MOVEit proved the method. It now runs on every source below, on a fixed schedule, catching new breaches and keeping existing ones current: revised counts, newly named victims, corrections, lawsuits and settlements. Each update is tested against what the graph already knows, which is how patterns and anomalies come to light. Collection is automatic; a change reaches a published count or a client report only after review.
Watching now
- SEC filings every 15 minutes
- HHS breach portal every 30 minutes
- Multiple state breach registers daily
- Court records overnight, for the cases we follow
- Ransomware leak sites every 15 minutes, captured a median of 10 minutes after listing
- CISA’s exploited vulnerabilities and CVE records hourly
- Security news hourly
Being added now: more state registers, CISA and FBI advisories, vendor security advisories, new class-action complaints, ransom-payment wallets and MITRE ATT&CK updates. See the plan.
We hold breach registers from 20 states, each with the date of its newest entry. Every source and when we last checked it, as of 21 October 2026.
Method · Patent Pending
How BreachGraph counts
Public tallies such as Emsisoft’s MOVEit count add up reports as published and warn that some people are counted more than once. BreachGraph reconciles reports by custody instead: it removes the duplicate and overlapping counts it can identify and keeps separate breaches separate.
Follow custody
Every exposure is tied to the custodian that ran the breached server, the data owners whose records were on it, and any intermediaries between them.
Count exposures, not people
Superseded and repeated counts are removed. Unique-person totals are never claimed, because no one can know them.
Show the confidence
Each custodian is rated from low to high by its evidence. Only moderate or higher enters totals, and an attacker’s claim alone never raises a rating.
Test competing explanations
When the evidence fits more than one explanation, each stays open until the evidence rules it out.
Flag what doesn’t fit
A count that jumps or a timeline that doesn’t line up is flagged and tested, not averaged away.
Read the full methodSee it worked through on PBI’s custody path
Why MOVEit
The case that forced every distinction
At the end of May 2023, Cl0p used one flaw in MOVEit Transfer to take files from servers run by government agencies, insurers, universities and their vendors. Much of that data belonged to someone else, often several hops away: an insurer’s customers, sent to a policy administrator, passed on to a research vendor.
Saying who was exposed, and through whom, meant separating who ran each breached server, whose data was on it, the route it took, and which notices described the same people. MOVEit needed all four at once, so BreachGraph was built on it. The filings, settlements and rulings still arriving keep testing that foundation.
Who it's for
Built for people who have to defend every number
Independent consultants
Brief clients on vendor and fourth-party exposure with evidence they can check themselves.
Litigation support
Give counsel a sourced chronology: who ran the breached system, whose data reached it, and the filing behind each step.
Researchers
Work from reconciled counts and custody paths instead of re-summing press reports.
Journalists
Trace a figure to the filing behind it before it goes to print.
Vendor-risk and insurance teams
See a vendor's breach roles and their consequences before renewal or underwriting.