Organization census
MOVEit 2023: 1,877 organizations
How BreachGraph counts the organizations caught up in the 2023 MOVEit campaign in either role: running a breached server, or having data that reached one. This is the record behind the organization total on the homepage. It is a working census, and the count of distinct companies will change as names are matched to legal entities. This page is fixed: a new census gets a new page.
The total
| Role | Organizations |
|---|---|
| Ran a breached MOVEit server | 171 |
| Data owners and intermediaries whose data reached a breached server they didn’t run | 1,718 |
| Less those in both roles | −12 |
| Total | 1,877 |
The 171 that ran a breached server
Each is on BreachGraph’s 21 October custodian list at moderate confidence or higher: 101 high, 8 moderate–high and 62 moderate. Ratings follow the confidence ladder in the method.
What counts as an organization here
- A unit is an organization matched to one identity, or, where a source names it in a way that can’t yet be matched, a provisional unit tied to that source, incident and role.
- Included: data owners and intermediaries that a source places in the incident, even when the name can’t yet be matched to a company, and 6 unnamed intermediaries that sources describe.
- Excluded: names that appear without a role in the incident, unsupported leads, and labels that only assemble a count.
- A family relationship alone does not merge companies. Separately identified organizations stay separate until evidence shows they are the same counting unit.
- Being in the census changes no exposure count.
Not yet a count of unique companies
334 units are provisional, still being matched to a legal entity: 327 data owners and intermediaries and 7 custodian units. Some may turn out to be an organization already counted, so the total can move down as well as up. The census is not a count of unique legal entities or of parent companies.
Why the total is 1,877, not 1,878
The census itself holds 1,878 units, including 172 custodian units. The 172nd is Bank of America’s engagement with EY, which the custodian list counts under EY (US), and Bank of America is already counted among the data owners. The homepage uses the list’s 171 custodians with the census’s 1,718 and 12, so the parts add up to the total shown.
The record
Census BG_MOVEIT_ORG_CENSUS_20261021_001 (version 9), captured 21 October 2026, with custodian list MOVEIT_BSC_LIST_20261021_003 of the same day. Every unit is tied to the source occurrences that name it.
How to cite this census
BreachGraph (Torgen Inc.), “MOVEit 2023 organization census,” BG_MOVEIT_ORG_CENSUS_20261021_001, 21 October 2026, https://breachgraph.net/releases/moveit-census-2026-10-21.
What vetted reviewers can see
The unit list, the source behind each unit, and the matches still open. Request access.
Corrections
Know an organization we missed, or two we count separately that are the same? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next census.