Comparison

How other trackers count MOVEit

Figures as each publisher gave them · last checked 21 October 2026

Several groups have counted Cl0p’s 2023 MOVEit campaign. Their figures differ mostly because they count different things, at different dates. Here they are side by side with what each one counts, so a figure can be quoted with its unit. None of them is an input to BreachGraph’s count.

People

Source	Figure	What it counts	As of
BreachGraph, count release	115,986,845	Reported exposures, reconciled by custody: each affected population counted once, from its best report	19 Oct 2026
Privacy Rights Clearinghouse, Data Breach Chronology	At least 99.4 million	People in U.S. state and HHS notices PRC lists under Progress Software as the breach source, including one unrelated 13.4 million notice (see below)	20 Oct 2026
Emsisoft	95,788,491	Individuals in published counts, added together; Emsisoft notes it can’t account for people counted more than once	28 Jun 2024
Cybersecurity Dive	About 93.3 million	Records exposed, from public disclosures and regulator filings; some people were exposed more than once	1 Jan 2024
KonBriefing Research	85.1–89.9 million	Person records; overlap isn’t removed, and the publisher warns that some people are counted more than once	20 Dec 2023
Identity Theft Resource Center, via Governing	About 72.7 million	Estimated victims; the source doesn’t say whether people in more than one notice are counted once	22 Feb 2024
DisclosureLens	Not published	Groups filings into incidents; no campaign-wide total on its public pages	20 Oct 2026

None of these is a count of unique people, and BreachGraph doesn’t claim one: no one can know it. PRC counts exposures, taking the largest count among each breach event’s filings (2026 midyear report). On 20 October its Progress Software grouping also included Kaiser Foundation Health Plan’s notice to 13.4 million people about tracking technology on its websites, a separate 2024 disclosure unrelated to MOVEit. All of PRC’s figures on this page come from that grouping.

Organizations

Trackers count two kinds of organization: those that ran a breached MOVEit server, and those whose data sat on someone else’s server. BreachGraph calls the first kind breached-system custodians and keeps the second separate.

Source	Figure	What it counts	As of
BreachGraph, saved custodian list	171	Organizations that ran a breached MOVEit server, at moderate confidence or higher	21 Oct 2026
Identity Theft Resource Center, Q3 2023 report	79 direct, 344 through vendors	Organizations in ITRC’s U.S. data reporting direct attacks on MOVEit, and those hit through one or more vendors using it	30 Sep 2023
Emsisoft’s Brett Callow, via TechTarget	2,098 known, 1,690 through third parties	Known victim organizations, and those compromised through third parties; the remaining 408 may include organizations known only from Cl0p’s leak site	Reported 26 Sep 2023
Cybersecurity Dive	At least 100 direct, more than 2,700 in all	MOVEit customers compromised directly, and all victim organizations; it found 84% of known victims were hit through vendors	1 Jan 2024
Emsisoft	2,773	Organizations known to be affected, directly or through vendors, drawing partly on Cl0p’s leak site	28 Jun 2024
KonBriefing Research	2,611	Organizations known to be affected, with no split between direct and through vendors; includes some unconfirmed victims	20 Dec 2023
Identity Theft Resource Center, via Governing	1,417	Organizations identified as impacted, in ITRC’s U.S. data	22 Feb 2024
Privacy Rights Clearinghouse, Data Breach Chronology	126	Organizations PRC lists under Progress Software as the breach source, server operators and downstream organizations together	20 Oct 2026
Progress Software, Form 10-K	2	Customer environments on its dedicated MOVEit Cloud service that were exploited; it gives no count for MOVEit Transfer servers its customers ran themselves	26 Jan 2024

Notices

Source	Figure	What it counts	As of
Verizon 2024 DBIR, via TechTarget	1,567	Breach notifications tied to MOVEit in Verizon’s dataset	31 Oct 2023
Privacy Rights Clearinghouse, Data Breach Chronology	328	U.S. notices PRC lists under Progress Software as the breach source	20 Oct 2026

PRC’s figures on this page are from its vendor cascade view. Its vendor-event detail for Progress Software showed different figures the same day: 1,559 notices and 193 organizations, with 99,251,464 exposures reported for 189 of them.

Figures that aren’t MOVEit victim counts

Source	Figure	What it counts	As of
Censys, via Cybersecurity Dive	More than 3,000	MOVEit environments exposed to the internet before the flaw was disclosed or patched: exposure, not compromise	Before 31 May 2023
CISA and FBI, advisory AA23-158A	More than 3,000 U.S., 8,000 worldwide	Organizations TA505 is estimated to have compromised across all its activity, not in the MOVEit campaign alone. Sometimes quoted as a MOVEit count.	7 Jun 2023

Why the figures differ

They count different things. People, person records, exposures, notices and organizations aren’t interchangeable, and a figure means little without its unit.
They stop at different dates. Most MOVEit tallies stopped updating in 2023 or 2024. Notices, revised counts and court records have kept arriving since.
They treat repeated reports differently. When a vendor and its clients each send notices about the same people, adding the notices counts those people twice. Emsisoft and KonBriefing say they don’t remove that overlap. PRC takes the largest count within each breach event; its published method doesn’t describe removing overlap between a vendor’s notice and its clients’. BreachGraph follows the data from the server that was hit to each data owner, and counts each population once along that route.
They draw on different sources. Some cover U.S. notices only. Some include organizations known only from Cl0p’s leak site, which is an attacker’s claim.

The two closest services: PRC and DisclosureLens

Both turn regulators’ breach notices into searchable records. PRC’s Data Breach Chronology covers 20 state agencies, most of them attorneys general, and HHS. It names the vendor behind a breach and links each affected organization to it (PRC, September 2026). DisclosureLens covers SEC filings, 20 state attorneys general, HHS, EU and Singapore regulators and leak-site claims, which it labels unverified, and groups one incident’s filings across jurisdictions into a single record (its methodology).

Neither one’s published method describes tracing the route data took through intermediaries to the server that was hit, or reconciling counts across the organizations on one route, such as a vendor’s notice and its clients’ notices about the same people. That is the work BreachGraph’s count rests on. It names the organization that ran each breached server, with a confidence level. It records each step of the route, marking the steps that are inferred rather than stated in a filing. And it keeps a record of why each reported count was included or held back, open to vetted reviewers with its own copies of the sources.

Based on PRC’s and DisclosureLens’s published methods as of October 2026. Their search pages and paid services may show more.

Corrections

If we’ve described another tracker’s figure or method wrongly, write to tips at torgen.us. We’ll correct it and note the change on this page.