Count release
MOVEit 2023: 115,999,004 reported exposures
BreachGraph’s count of the people exposed in Cl0p’s 2023 MOVEit Transfer campaign, built from published filings and reports and reconciled by custody. This page is fixed: a later count gets a new release and a new page.
What changed since 19 October
Two Paycor customers are now counted: the Diocese of Lansing, 4,124 people, and the Archdiocese of Detroit, 8,035. Both told regulators that payroll data on their employees, held by Paycor, was accessed without authorization through the MOVEit Transfer software Paycor used. Indiana’s breach register gives each total, and their notices to Maryland’s Attorney General name Paycor and MOVEit Transfer.
The 19 October release held them out while a possible overlap with the Michigan Catholic Conference was reviewed. The Conference counts 12,652 retirement-benefit recipients, also through Paycor. Each of the three organizations notified its own population, on its own date, and no source says one population is a copy or part of another. So each is counted once. Some diocesan employees may also receive Conference retirement benefits. That overlap can’t be measured from the filings, so nothing is deducted for it. Paycor’s total rises from 30,496 to 42,655, and the release total by 12,159. Nothing else changes.
What the number counts
Reported exposures, not unique people. Each affected population is counted once, from the best available report, and the selected populations are added up. Someone notified by two organizations, or caught in two breaches, can still appear twice. No one can know how many unique people were affected, so BreachGraph never claims that number.
How the count is built
- 162 breach-event records in the release
- 130 contribute a count
- 30 have no reliable count yet: unknown, not zero
- 1 is a selected zero, from the organization’s own dated finding that no data was taken
- 1 was superseded by a later record
Under those events sit 299 reported population figures, of which 241 contribute. The source figures add up to 136,200,065. BreachGraph holds 20,201,061 of that out of the total: repeated reports of the same people, subsets of a larger figure already counted, superseded reports, figures that belong to a different incident, and counts that aren’t counts of people.
What it rests on
| Evidence behind the figure | Exposures | Share |
|---|---|---|
| Primary evidence checked | 106,225,597 | 91.6% |
| Accepted analyst inferences, confidence disclosed | 7,290,319 | 6.3% |
| Previously accepted evidence, carried forward | 2,158,518 | 1.9% |
| Primary counts, with the custody route inferred | 192,376 | 0.2% |
| Open source, attribution or assembly questions | 125,852 | 0.1% |
| Primary counts, with the link to the employer’s incident inferred | 6,342 | <0.1% |
| Total | 115,999,004 | 100% |
The two new Paycor populations sit in “previously accepted evidence”. Their totals come from BreachGraph’s copy of Indiana’s register rather than a fresh reading of the register itself, while their link to Paycor and MOVEit was checked in the original Maryland notices.
Notable choices carried forward
- A 4.3 million population reported for a separate 2024 incident is left out. Nothing in the evidence ties it to MOVEit. The organization stays in the release as an inferred MOVEit breach with an unknown count.
- 12,352,524 database rows reported for one organization are left out, because rows are not people.
- A 91,269 population first linked to MOVEit is left out: the organization’s own notice describes a different intrusion.
- Maximus is counted at 9,179,390, the conservative figure in its report to HHS OCR, rather than an earlier estimate of 11.3 million. Its clients’ separately filed figures add nothing, because their overlap with it can’t be ruled out.
- Louisiana’s Office of Motor Vehicles is counted at 3,404,603, a stated proxy: the state’s licensed drivers, based on its belief that the exposure was statewide. The six million records it cited are not treated as six million people.
Which way it could move
Up, as the 30 events without a count get one. Down, if populations now counted separately turn out to overlap. Each change comes as a new release, and earlier releases stay citable.
Compared with other tallies
Emsisoft’s MOVEit tally reached 95,788,491 people as of 28 June 2024. It adds up reported figures as published; this release reconciles them by custody and runs to 26 October 2026. The two use different cutoffs and counting units, so the gap is not a count of additional people.
How to cite this release
BreachGraph (Torgen Inc.), “MOVEit 2023 count release,” MOVEIT_COUNT_RELEASE_20261026_001, 26 October 2026, https://breachgraph.net/releases/moveit-2026-10-26.
Short form: “115,999,004 reported exposures, not unique people (BreachGraph, 26 October 2026).”
What vetted reviewers can see
The full contribution ledger, BreachGraph’s preserved copies of each source with their file hashes, and the decision record behind every selection and hold. Request access or the MOVEit whitepaper.
Corrections
Found a figure we got wrong or a filing we missed? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next release.