Exposure breakdown
MOVEit 2023: whose data, and what kind
How BreachGraph splits the reported exposures in its 19 October 2026 count release by the kind of data and by whose data it was. These are the figures behind the two shares on the homepage. This page is fixed: a new breakdown gets a new page.
The denominator
Every share on this page is a share of 115,986,845 reported exposures, the total of count release MOVEIT_COUNT_RELEASE_20261019_002. They are exposures, not unique people. The breakdown sorts the release’s 248 count lines, each a population on one custody route, and adds nothing to the total.
By kind of data
| Kind of data | Exposures | Share |
|---|---|---|
| Reported to HHS under HIPAA, at least | 60,969,671 | 52.6% |
| Other health data | 3,414,025 | 2.9% |
| Non-health | 51,603,149 | 44.5% |
| Total | 115,986,845 | 100% |
By whose data it was
| Whose data | Exposures | Share |
|---|---|---|
| Held for another organization, at least | 85,293,084 | 73.5% |
| Reported upstream of the custodian | 39,940,556 | 34.4% |
| The custodian’s own HHS report as a business associate | 36,148,531 | 31.2% |
| A service provider’s report covering its clients’ data | 9,203,997 | 7.9% |
| The custodian’s own, or not distinguished | 30,693,761 | 26.5% |
| Total | 115,986,845 | 100% |
How each line is classified
- Reported to HHS under HIPAA: the line’s count is bound to a report to the HHS Office for Civil Rights, or its organization reported this incident to HHS (checked against BreachGraph’s preserved copy of the HHS breach portal), or a recorded decision says so.
- Other health data: a population named as health data that was not reported to HHS.
- Non-health: everything else.
- Held for another organization: the custodian’s own HHS report as a business associate, which means it held the data for a covered entity; a service provider’s report covering its clients’ data; or a route that runs through a data owner or intermediary, or a population that names an organization other than the custodian.
- The custodian’s own, or not distinguished: everything else.
This classifies populations. It is not a data-type field recorded for each person.
HHS reports inside a larger count
Eleven organizations reported the incident to HHS while their counted population came from a larger figure filed elsewhere. Those 4,037,366 exposures are counted as HIPAA-reported inside that population, not added to it. The filings don’t say which routes those people were on, so each move is recorded per incident rather than per line. HHS reports outside the release total are not counted: for example, CMS’s and Virginia DMAS’s reports on the Maximus breach, which the release counts once, at Maximus.
Why both shares are minimums
An HHS report that covers only part of a counted population is noted, not apportioned, so no estimate pushes either share up. Better evidence can raise the HIPAA and held-for-another-organization shares; this method does not overstate them.
The record
Breakdown MOVEIT_EXPOSURE_BREAKDOWN_20261021_002, saved 21 October 2026 from count release MOVEIT_COUNT_RELEASE_20261019_002. It replaced breakdown _001, saved the same evening, which did not yet count HHS reports inside larger populations. A new count release means a new breakdown and new homepage shares.
How to cite this breakdown
BreachGraph (Torgen Inc.), “MOVEit 2023 exposure breakdown,” MOVEIT_EXPOSURE_BREAKDOWN_20261021_002, 21 October 2026, https://breachgraph.net/releases/moveit-breakdown-2026-10-21.
What vetted reviewers can see
The classification of every line with its basis, and the per-incident HHS adjustments. Request access or read the method.
Corrections
Found a figure we got wrong or a filing we missed? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next breakdown.