Exposure breakdown
MOVEit 2023: whose data, and what kind
How BreachGraph splits the reported exposures in its 26 October 2026 count release by the kind of data and by whose data it was. These are the figures behind the two shares on the homepage. This page is fixed: a new breakdown gets a new page.
The denominator
Every share on this page is a share of 115,999,004 reported exposures, the total of count release MOVEIT_COUNT_RELEASE_20261026_001. They are exposures, not unique people. The breakdown sorts the release’s 250 count lines, each a population on one custody route, and adds nothing to the total.
By kind of data
| Kind of data | Exposures | Share |
|---|---|---|
| Reported to HHS under HIPAA, at least | 60,969,671 | 52.6% |
| Other health data | 3,414,025 | 2.9% |
| Non-health | 51,615,308 | 44.5% |
| Total | 115,999,004 | 100% |
By whose data it was
| Whose data | Exposures | Share |
|---|---|---|
| Held for another organization, at least | 85,305,243 | 73.5% |
| Reported upstream of the custodian | 39,952,715 | 34.4% |
| The custodian’s own HHS report as a business associate | 36,148,531 | 31.2% |
| A service provider’s report covering its clients’ data | 9,203,997 | 7.9% |
| The custodian’s own, or not distinguished | 30,693,761 | 26.5% |
| Total | 115,999,004 | 100% |
How each line is classified
- Reported to HHS under HIPAA: the line’s count is bound to a report to the HHS Office for Civil Rights, or its organization reported this incident to HHS (checked against BreachGraph’s preserved copy of the HHS breach portal), or a recorded decision says so.
- Other health data: a population named as health data that was not reported to HHS.
- Non-health: everything else.
- Held for another organization: the custodian’s own HHS report as a business associate, which means it held the data for a covered entity; a service provider’s report covering its clients’ data; or a route that runs through a data owner or intermediary, or a population that names an organization other than the custodian.
- The custodian’s own, or not distinguished: everything else.
This classifies populations. It is not a data-type field recorded for each person.
HHS reports inside a larger count
Eleven organizations reported the incident to HHS while their counted population came from a larger figure filed elsewhere. Those 4,037,366 exposures are counted as HIPAA-reported inside that population, not added to it. The filings don’t say which routes those people were on, so each move is recorded per incident rather than per line. HHS reports outside the release total are not counted: for example, CMS’s and Virginia DMAS’s reports on the Maximus breach, which the release counts once, at Maximus.
Why both shares are minimums
An HHS report that covers only part of a counted population is noted, not apportioned, so no estimate pushes either share up. Better evidence can raise the HIPAA and held-for-another-organization shares; this method does not overstate them.
The record
Breakdown MOVEIT_EXPOSURE_BREAKDOWN_20261026_001, saved 26 October 2026 from count release MOVEIT_COUNT_RELEASE_20261026_001. It replaces the 21 October breakdown and adds two lines: the Diocese of Lansing (4,124) and the Archdiocese of Detroit (8,035), payroll data on their employees held by Paycor. Both are non-health data held for another organization. Every other line and all eleven HHS moves are unchanged, and both homepage shares round to the same figures as before. A new count release means a new breakdown and new homepage shares.
How to cite this breakdown
BreachGraph (Torgen Inc.), “MOVEit 2023 exposure breakdown,” MOVEIT_EXPOSURE_BREAKDOWN_20261026_001, 26 October 2026, https://breachgraph.net/releases/moveit-breakdown-2026-10-26.
What vetted reviewers can see
The classification of every line with its basis, and the per-incident HHS adjustments. Request access or read the method.
Corrections
Found a figure we got wrong or a filing we missed? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next breakdown.