Litigation brief

How MOVEit litigation is reshaping the global cyber risk landscape

BreachGraph, Torgen Inc. · 21 October 2026 · evidence through 21 October 2026

Evidence, accountability and financial exposure across the data supply chain. For cybersecurity consultants, vendor-risk leaders, insurers and counsel.

Executive assessment

MOVEit has turned a shared software vulnerability into a prolonged test of how organizations develop software, operate transfer systems, entrust data to suppliers and document their decisions. The UK’s National Cyber Security Centre reported data stolen from organizations whose supply chains used MOVEit. More than three years after the 2023 attacks, the U.S. federal proceeding still had 233 actions pending out of 349 historical actions on 1 October 2026. [1, 2]

BreachGraph’s assessment is that the most consequential change is the demand for evidence across the whole data-custody chain. Courts are examining different duties for software suppliers, operators and customers. Settlements resolve selected relationships while leaving others open. Regulators are testing retention and response practices. These developments make documented responsibility a practical input to procurement, underwriting and incident response. [3–5, 11, 16, 17]

Responsibility extends across organizational boundaries. Each party’s role, conduct and contractual position requires its own analysis.
Security controls matter before, during and after exploitation. Vendor selection, deployment settings, retained data and reporting decisions all generate evidence.
Financial exposure develops over years. Response and defense spending can consume insurance before final liability is determined.
Global relevance requires local legal analysis. U.S. litigation, European accountability rules and Canadian regulatory decisions support related questions with different legal tests.

The documented changes concern litigation, enforcement and company disclosures. Broader effects on worldwide premiums, contract terms and loss rates remain analytical implications, not measured outcomes of this paper. Settlements and pleading-stage rulings carry different evidentiary weight from findings on the merits.

1. The relevant unit of risk is the custody relationship

A software supplier, the organization operating a compromised server and an organization whose data reached that server occupy different positions. Intermediaries can add further steps. A single company can occupy several roles across separate events. BreachGraph uses “breached-system custodian” for the organization operating the compromised environment; this is an analytical category, distinct from statutory terms such as controller, processor or health information custodian. [25] “Data owner” is a descriptive label for the organization responsible for the source population.

The resulting risk has two dimensions. Organizations using the same vulnerable product share a technical dependency even when they operate separate servers. Organizations relying on the same custodian share an operational dependency and can be affected through one environment. An insurer or buyer needs both views to understand concentration.

Role	Question the evidence must answer	Useful records
Software supplier	How were relevant weaknesses identified, tested and addressed?	Code review, tests, advisory history and product representations.
System operator	How was the deployment configured, monitored and used to retain data?	Configuration history, logs, retention settings and incident records.
Customer or intermediary	How was the receiving organization selected and overseen?	Data-flow map, vendor assessment, contract and follow-up evidence.

Table 1. BreachGraph’s proposed evidence model, informed by the role distinctions in the MOVEit orders. These are review questions, not findings that any listed practice was absent. [3–5]

2. Courts are testing reasonable care at several layers

Software development and deployment

On 31 July 2025, MDL Order 22 granted dismissal of some claims against Progress and allowed others to proceed; the negligence count survived except for claims under Indiana law. As the order summarizes the complaint, Cl0p exploited SQL injection and .NET deserialization flaws, SQL injection was a long-documented and preventable weakness, and Progress made security representations and supplied patches and support. The order assessed the sufficiency of allegations; it did not adjudicate the truth of the technical allegations. [3]

Order 23 addressed direct users and vendor-contracting entities. The court considered deployment controls such as access restrictions and monitoring, and customer-side duties involving vendor selection and oversight. Its treatment varied by claim and applicable state law. This supports a practical distinction: the supplier’s software design and the customer’s deployment or oversight conduct can generate separate lines of inquiry. [4]

Evidence must match the alleged failure

A May 2026 discovery order, MDL Order 34, made that distinction concrete. The magistrate judge denied the bellwether plaintiffs’ request for discovery into vendor-contracting entities’ own cybersecurity practices, explaining that the case against them concerned selecting and overseeing vendors handling sensitive data. It required a limited response on whether certain data-valuation documents existed. The operational lesson is to preserve the records tied to the relevant custody relationship and alleged conduct. [5]

Public statements also require claim-specific treatment. Order 23 dismissed a New York General Business Law § 349 deception claim against PBI and Genworth: apart from the breach itself, the complaint did not allege that their security statements were false when made, or that either company knew its security was inadequate. Archive the actual statement, its date, scope and supporting evidence before drawing a conclusion about misrepresentation. [4]

Procedural boundaries remain consequential

Order 32, dated 6 February 2026, dismissed for lack of Article III standing all MDL cases filed before 15 August 2023, the date plaintiffs allege Cl0p began disclosing stolen data, because those complaints could not plausibly allege misuse or a substantial risk of harm traceable to the breach. Order 33 subsequently declined to dismiss fifteen cases wholesale where an operative amended complaint was filed on or after that date. The operative pleading and alleged harm timeline therefore matter; the date is a feature of this litigation’s reasoning, not a universal cutoff for breach claims. [6, 7]

On 26 June 2026, Order 37 declined to dismiss the bellwether plaintiffs’ negligence claims under the economic-loss doctrine at that stage, while permitting further briefing later. A claim that survives dismissal remains subject to later evidentiary and legal tests. [8]

3. Settlements reveal how responsibility is negotiated

Selected settlements illustrate different positions in the custody chain. National Student Clearinghouse used MOVEit in its operations. EY handled Bank of America information, and both organizations are settling defendants. Bank of Canton settled customer claims arising from an incident at a third-party service provider. The customer-facing organization therefore remains relevant even where its own server was not the compromised system. [10–12]

Matter	Gross fund	Status at cutoff	Custody significance
National Student Clearinghouse [9, 10]	$9.95m	Final approval 13 May 2025, per administrator.	Operator held data supplied by other organizations.
EY and Bank of America [11]	$2.50m	Final approval order, 15 October 2026.	Both operator and data owner are settling defendants.
Bank of Canton [12, 13]	$0.30m	Final approval order, 21 October 2025.	Customer claims settled after a service-provider incident.
Cadence Bank [14]	$5.25m	Preliminary approval 5 January 2026. Final approval not verified.	Direct MOVEit user; scheduled hearing alone does not prove approval.
GRIPA [15]	$2.15m	Proposed agreement. Final hearing set for 12 November 2026.	Health-data custodian; pending status preserved.

Table 2. Selected examples, not a complete settlement census. Amounts are gross funds in U.S. dollars, not amounts received by individual claimants. “Final approval” does not establish that distributions are complete. Cadence’s settlement website still lists a 9 July 2026 final hearing and says the court has yet to decide; we found no final approval order. [9–15]

Release scope is as important as the named defendant. Nuance’s final order defines released parties and claims while expressly excluding claims against Progress. A settlement can therefore resolve one portion of the custody chain while litigation continues elsewhere. Read the agreement and order before treating a client, affiliate or software supplier as released. [16]

The foundation paper’s ten-settlement inventory records nine agreements involving a breached-system custodian, with Bank of America also included in the EY agreement, and Bank of Canton as the data-owner example. This is a descriptive result from a dated, mixed-status sample. It does not estimate the chance of being sued, establish which party ultimately funded a payment, or prove that custody determines legal liability. [25]

Per-class-member ratios are useful comparison fields only when their denominator and release scope are explicit. Class membership, notification populations, affected exposures and unique people are different measures. Fund size also reflects procedure, benefit design, administration, fees, available resources and negotiated terms. A small set of early settlements cannot isolate the causal effect of organization role or support a universal damages rate.

4. Retention and response decisions create separate exposure

The New York Department of Financial Services’ 29 April 2026 consent order with Delta Dental Insurance Company and Delta Dental of New York, Inc. imposed a $2.25 million penalty. It found four violations of the state’s cybersecurity regulation, covering incident-response policy and planning, data retention and disposal, and late notice to the Department. The order describes how their affiliate Delta Dental of California, which licensed MOVEit Transfer, extended or disabled the default retention setting with no written process for approving such changes. It also prohibits reimbursement or indemnification of the penalty, including through insurance. These are findings and terms in a regulatory consent order, distinct from the allegations in the civil cases. [17]

BreachGraph’s implication is straightforward: decisions about how much data remains on a transfer system and how a reportable event is escalated can change the consequences of an intrusion. Preserve the actual retention configuration, exceptions and decision timestamps. A written policy and an operating setting should be reviewed together.

The Ontario outcome provides an essential counterweight. In August 2024, the Information and Privacy Commissioner closed its review of a MOVEit breach involving approximately 3.4 million people’s health information at Ontario’s prescribed perinatal, newborn and child registry. It found the response adequate, including containment, investigation, notice and remediation, while reserving the ability to reopen the matter. This was a regulatory assessment of that response, not a civil judgment resolving every possible claim. [19]

The comparison supports evaluating evidence of conduct in context. A large exposed population can coexist with an adequate response finding. An undocumented control remains unknown; a later change in a public assessment requires examination of the evidence then available.

5. The financial tail extends beyond settlement funds

Progress’s Form 10-Q for the quarter ended 31 August 2026 reports $6.1 million of net MOVEit-related costs for the first nine months of fiscal 2026, after $4.5 million of insurance recoveries. It states that Progress maintained $15.0 million of cybersecurity insurance coverage and had utilized all coverage available for the MOVEit vulnerability. The company expected continuing legal and professional costs, considered a loss reasonably possible, and could not reasonably estimate a range of possible losses. These are company-reported expenses and coverage disclosures, not a campaign-wide loss estimate or judgment amount. [18]

For underwriting and reserving, BreachGraph recommends tracking response costs, defense spending, settlement obligations, regulatory amounts and recoveries separately. Record gross and net treatment and the relevant reporting period. Adding a settlement fund to a company’s reported incident costs without checking their contents can count the same obligation twice.

For accumulation analysis, preserve both the shared software dependency and the specific custodians on which insured organizations relied. Then map each policy’s treatment of defense costs, limits, related claims, exclusions and recoveries. The MOVEit record gives a concrete reason to examine those terms; it does not establish how an unreviewed policy responds.

6. Why the implications are global

The transmission mechanism is shared technology and cross-border data processing. Multinational buyers can apply questions arising in MOVEit litigation to vendors serving several jurisdictions. The legal consequences must still be evaluated under the law governing the entity, processing activity and claim. The following comparisons describe distinct frameworks, not foreign holdings in the U.S. MOVEit proceeding.

United Kingdom: ongoing controller oversight

The NCSC reported data stolen from organizations whose supply chains used MOVEit and said it was working with UK organizations to respond. ICO guidance separately says controllers must use only processors that provide sufficient guarantees, must put appropriate contracts in place, and should check processors’ compliance on an ongoing basis. A vendor relationship does not end the controller’s accountability. For a UK buyer, the useful MOVEit question is whether its processor assessment and follow-up records address the actual service, data and onward processing involved. [1, 20]

European Union: visibility through the processing chain

EDPB Opinion 22/2024 states that controllers should have the identities of processors and sub-processors readily available and verify sufficient guarantees, with the depth of verification reflecting risk. It also explains that obtaining every sub-processing contract is not a systematic requirement. This supports a practical, proportionate custody map with evidence for material dependencies, including onward transfers. [21]

In a separate Bulgarian cyberattack case, C-340/21, the Court of Justice held that unauthorized access alone does not establish inadequate safeguards, while the controller bears the burden of proving their appropriateness. Fear of future misuse can qualify as non-material damage under the applicable conditions. The relevant lesson is the need to connect safeguards, responsibility and harm; this decision concerns a different incident. [22]

DORA adds a financial-sector framework covering ICT third-party risk, contractual provisions, information registers and oversight of critical providers. NIS2 addresses cybersecurity risk management and supply-chain security across covered sectors through national implementation. Both were adopted on 14 December 2022, before the MOVEit campaign. MOVEit supplies a concrete scenario against which to examine their practical concerns; the campaign did not create those regimes. [23, 24, 27]

Canada: the response record can support a favorable finding

Ontario’s decision illustrates why a global analysis must preserve favorable findings alongside enforcement outcomes. Evidence of containment, investigation, notice and remediation can materially affect the regulator’s assessment. Importing a U.S. settlement ratio would not reproduce that legal analysis. [19]

7. What organizations should change

The following are BreachGraph recommendations derived from the evidence above. They are intended for a concrete vendor review or underwriting engagement.

Map one material data flow through every known intermediary to the operating environment. Record organization identity, role, service, data categories, geography and whether the relationship remains active.
Request evidence specific to that environment: approved configuration, retention and deletion records, relevant assurance scope, remediation status and the process for investigating alerts. Record missing evidence as an open question.
Review contracts against the actual flow. Test onward-processing disclosure, incident cooperation, access to evidence, notification responsibilities, deletion, liability allocation and insurance provisions against the parties’ roles.
Preserve separate timestamps for the incident, discovery, publication and each analytical revision. Retain earlier statements so later conclusions can be understood without rewriting the historical record.
Maintain a matter register linking complaints, operative pleadings, court rulings, settlement agreements, final orders and payment status. Keep financial recognition, cash payment and insurance recovery distinct.
Test a shared-custodian scenario across the vendor or insurance portfolio. Identify correlated exposures, unresolved overlaps and the evidence needed to quantify a loss scenario.

8. BreachGraph’s contribution

BreachGraph’s evidence model connects an organization to its role in an incident, the documented path of data custody, the affected population and the legal or regulatory consequences that follow. Each link should retain its source, date, evidentiary status and reasoning. This makes it possible to ask which organizations shared an exposure, which relationships remain uncertain and which later record changed the assessment. [25]

For this purpose, a complaint is an allegation, an interlocutory order is a procedural decision, a settlement is a negotiated resolution and a regulator’s finding is recorded in its stated scope. A custody link does not establish a legal duty or causation. The model’s value is to make the evidence needed for those separate judgments accessible and reviewable.

The first practical deliverable should be a custody-and-consequences review for one material vendor: a supported data-flow map, the relevant litigation and regulatory history, unresolved evidence requests and a dated recommendation. That is a useful starting point for wider portfolio work without claiming a validated loss model or guaranteed legal outcome.

Source notes and scope

Public sources were reviewed through 21 October 2026. The five settlement examples are selected to illustrate roles and status, not to estimate a complete global total. Pending, unverified and administrator-reported approval states are retained explicitly. The paper uses U.S., UK, EU and Ontario examples; jurisdiction-specific advice requires the applicable law and full facts.

This brief adapts the litigation themes of Torgen’s earlier health-data litigation analysis and the foundation paper’s custody method. It uses public court, regulator, administrator and company materials for the factual examples. [25, 26]

References

How to cite this brief

BreachGraph (Torgen Inc.), “How MOVEit litigation is reshaping the global cyber risk landscape,” 21 October 2026, https://breachgraph.net/briefs/moveit-litigation.

Corrections

Found a ruling we described wrongly or a filing we missed? Send it to tips at torgen.us. We’ll review it and note any change on this page.