Organization census
MOVEit 2023: 1,877 organizations
How BreachGraph counts the organizations caught up in the 2023 MOVEit campaign in either role: running a breached server, or having data that reached one. This is the record behind the organization total on the homepage. It is a working census, and the count of distinct companies will change as names are matched to legal entities. This page is fixed: a new census gets a new page.
The total
| Role | Organizations |
|---|---|
| Ran a breached MOVEit server | 169 |
| Data owners and intermediaries whose data reached a breached server they didn’t run | 1,720 |
| Less those in both roles | −12 |
| Total | 1,877 |
The 169 that ran a breached server
Each is on BreachGraph’s 26 October custodian list at moderate confidence or higher: 102 high, 6 moderate–high and 61 moderate. Ratings follow the confidence ladder in the method.
What changed since 21 October
Two organizations moved from running a breached server to passing data to one. Adur and Worthing Councils’ report to their audit committee (26 September 2023) says their debt-collection contractors, Rundles and Jacobs, sent letter files to their print supplier, Adare SEC, and that it was Adare SEC’s MOVEit server that was compromised; Jacobs said it does not use MOVEit. Rundles and Jacobs are now counted as intermediaries, and Adare SEC’s own statement that its MOVEit server was accessed raises it to high confidence. The total is unchanged: two fewer custodians, two more intermediaries. The census of 21 October stays as it was published.
What counts as an organization here
- A unit is an organization matched to one identity, or, where a source names it in a way that can’t yet be matched, a provisional unit tied to that source, incident and role.
- Included: data owners and intermediaries that a source places in the incident, even when the name can’t yet be matched to a company, and 6 unnamed intermediaries that sources describe.
- Excluded: names that appear without a role in the incident, unsupported leads, and labels that only assemble a count.
- A family relationship alone does not merge companies. Separately identified organizations stay separate until evidence shows they are the same counting unit.
- Being in the census changes no exposure count.
Not yet a count of unique companies
334 units are provisional, still being matched to a legal entity: 329 data owners and intermediaries and 5 custodian units. Some may turn out to be an organization already counted, so the total can move down as well as up. The census is not a count of unique legal entities or of parent companies.
Why the total is 1,877, not 1,878
The census itself holds 1,878 units, including 170 custodian units. The 170th is Bank of America’s engagement with EY, which the custodian list counts under EY (US), and Bank of America is already counted among the data owners. The homepage uses the list’s 169 custodians with the census’s 1,720 and 12, so the parts add up to the total shown.
The record
Census BG_MOVEIT_ORG_CENSUS_20261026_001 (version 10), captured 26 October 2026, with custodian list MOVEIT_BSC_LIST_20261026_004 of the same day. It replaces census BG_MOVEIT_ORG_CENSUS_20261021_001 and list MOVEIT_BSC_LIST_20261021_003; four units changed and the other 1,874 are carried over unchanged. Every unit is tied to the source occurrences that name it.
How to cite this census
BreachGraph (Torgen Inc.), “MOVEit 2023 organization census,” BG_MOVEIT_ORG_CENSUS_20261026_001, 26 October 2026, https://breachgraph.net/releases/moveit-census-2026-10-26.
What vetted reviewers can see
The unit list, the source behind each unit, and the matches still open. Request access.
Corrections
Know an organization we missed, or two we count separately that are the same? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next census.