Count release
MOVEit 2023: 115,986,845 reported exposures
BreachGraph’s count of the people exposed in Cl0p’s 2023 MOVEit Transfer campaign, built from published filings and reports and reconciled by custody. This page is fixed: a later count gets a new release and a new page.
What the number counts
Reported exposures, not unique people. Each affected population is counted once, from the best available report, and the selected populations are added up. Someone notified by two organizations, or caught in two breaches, can still appear twice. No one can know how many unique people were affected, so BreachGraph never claims that number.
How the count is built
- 162 breach-event records in the release
- 130 contribute a count
- 30 have no reliable count yet: unknown, not zero
- 1 is a selected zero, from the organization’s own dated finding that no data was taken
- 1 was superseded by a later record
Under those events sit 299 reported population figures, of which 239 contribute. The source figures add up to 136,200,065. BreachGraph holds 20,213,220 of that out of the total: repeated reports of the same people, subsets of a larger figure already counted, superseded reports, figures that belong to a different incident, and counts that aren’t counts of people.
What it rests on
| Evidence behind the figure | Exposures | Share |
|---|---|---|
| Primary evidence checked | 106,225,597 | 91.6% |
| Accepted analyst inferences, confidence disclosed | 7,290,319 | 6.3% |
| Previously accepted evidence, carried forward | 2,146,359 | 1.9% |
| Primary counts, with the custody route inferred | 192,376 | 0.2% |
| Open source, attribution or assembly questions | 125,852 | 0.1% |
| Primary counts, with the link to the employer’s incident inferred | 6,342 | <0.1% |
| Total | 115,986,845 | 100% |
Notable choices in this release
- A 4.3 million population reported for a separate 2024 incident is left out. Nothing in the evidence ties it to MOVEit. The organization stays in the release as an inferred MOVEit breach with an unknown count. This change is why this release replaced the one published earlier the same day.
- 12,352,524 database rows reported for one organization are left out, because rows are not people.
- A 91,269 population first linked to MOVEit is left out: the organization’s own notice describes a different intrusion.
- Maximus is counted at 9,179,390, the conservative figure in its report to HHS OCR, rather than an earlier estimate of 11.3 million. Its clients’ separately filed figures add nothing, because their overlap with it can’t be ruled out.
- Louisiana’s Office of Motor Vehicles is counted at 3,404,603, a stated proxy: the state’s licensed drivers, based on its belief that the exposure was statewide. The six million records it cited are not treated as six million people.
Which way it could move
Up, as the 30 events without a count get one. Down, if populations now counted separately turn out to overlap. Each change comes as a new release, and earlier releases stay citable.
Compared with other tallies
Emsisoft’s MOVEit tally reached 95,788,491 people as of 28 June 2024. It adds up reported figures as published; this release reconciles them by custody and runs to 19 October 2026. The two use different cutoffs and counting units, so the gap is not a count of additional people.
How to cite this release
BreachGraph (Torgen Inc.), “MOVEit 2023 count release,” MOVEIT_COUNT_RELEASE_20261019_002, 19 October 2026, https://breachgraph.net/releases/moveit-2026-10-19.
Short form: “115,986,845 reported exposures, not unique people (BreachGraph, 19 October 2026).”
What vetted reviewers can see
The full contribution ledger, BreachGraph’s preserved copies of each source with their file hashes, and the decision record behind every selection and hold. Request access or the MOVEit whitepaper.
Corrections
Found a figure we got wrong or a filing we missed? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next release.