Method · Patent Pending

How BreachGraph counts

As applied in the MOVEit count release of 19 October 2026

BreachGraph turns breach notices, regulator filings, court records and leak-site postings into counts it can defend. Public tallies such as Emsisoft’s MOVEit count add up reports as published and warn that some people are counted more than once. BreachGraph reconciles reports by custody instead: it removes the duplicate and overlapping counts it can identify, keeps separate breaches separate, and says where overlap is still unresolved.

Follow custody

Every exposure is attached to the breached-system custodian that ran the server, the data owners whose records were on it, and any intermediaries in between.

Count exposures, not people

Counts are reported exposures. Superseded and downstream-repeated counts are removed. Unique-person totals are never claimed, because no one can know them.

Emsisoft’s MOVEit tally reached 95,788,491 people as of 28 June 2024. BreachGraph’s 19 October 2026 release selects 115,986,845 exposures. The two use different cutoffs and counting units, so the gap is not a count of additional people. See how other trackers count MOVEit.

Show the confidence

Each custodian carries a confidence level set by the evidence. Only moderate or higher enters campaign totals, and an attacker’s claim never raises confidence on its own.

  1. LowNamed on a leak siteShows: an attacker’s claim
  2. Low–moderatePlus an internet exposure scan of the vulnerable systemShows: the software was deployed
  3. ModeratePlus a breach notice (compromise), a patch disclosure (deployment) or a CISO termination (circumstantial)Shows: a compromise or deployment; the campaign link is inferred
  4. Moderate–highPlus an independent party naming its system as the one breached, such as a client's notice, a regulator record or a court filingShows: a compromise, named by someone else
  5. HighThe organization’s own disclosure of a compromise or containment tied to the campaign’s vulnerability, or that it ran the exploited software while notifying affected peopleShows: a compromise and the campaign link, in its own words

Test competing explanations

When the evidence fits more than one explanation, each one stays open as a hypothesis. Every item is weighed against all of them: it supports, contradicts, doesn’t tell them apart, or is unresolved. “Other or unknown” stays on the list, and nothing is forced into percentages that add up to 100.

It works like a differential diagnosis: the job is ruling explanations out. Each judgment records the evidence that would reopen it, and an inferred link stays labeled a hypothesis until evidence confirms it.

Flag what doesn’t fit

Each new filing is checked against what the graph already holds. Patterns, such as one vendor behind many notices or an organization that reports the same way across incidents, are recorded. Anomalies, such as a count that jumps between filings or a timeline that doesn’t line up, are flagged rather than averaged away.

An anomaly goes through the same test before it changes a count. Is it a supplemental notice, one state’s share of a national total, a separate incident or a different reporting role?

See it worked through

The homepage’s PBI path applies each step to one breached server: who ran it (PBI, rated high on its own notice), whose data reached it and through whom, and how the counts reconcile, with the public filing behind every step. See the PBI custody path.

The same method runs across the whole campaign in the MOVEit count release. The exposure breakdown and the organization census show how the homepage’s shares and organization total are calculated, and how other trackers count MOVEit sets the release beside outside figures.

Patent Pending

BreachGraph’s analytical framework and ontology are described in a U.S. provisional patent application filed on 13 October 2026.