Organization census
MOVEit 2023: 1,875 organizations
How BreachGraph counts the organizations caught up in the 2023 MOVEit campaign in either role: running a breached server, or having data that reached one. This is the record behind the organization total on the homepage. It is a working census, and the count of distinct companies will change as the remaining names are matched to legal entities. This page is fixed: a new census gets a new page.
The total
| Role | Organizations |
|---|---|
| Ran a breached MOVEit server | 169 |
| Data owners and intermediaries whose data reached a breached server they didn’t run | 1,718 |
| Less those in both roles | −12 |
| Total | 1,875 |
The 169 that ran a breached server
Each is on BreachGraph’s 26 October custodian list at moderate confidence or higher: 102 high, 6 moderate–high and 61 moderate. Ratings follow the confidence ladder in the method. The list is unchanged in this census.
What changed since 26 October
Provisional units fell from 334 to 73. Each of the 334 was a name a source placed in the incident that had not yet been matched to a company. BreachGraph checked every named one against registries (FDIC, NCUA, SEC, GLEIF, IPEDS, the NPI registry, Companies House) and the organizations’ own pages, and recorded the evidence for each match.
- 261 are now matched: 256 data owners and intermediaries and the 5 custodian units that were still provisional. 233 matched to one organization and 28 to a group of organizations, such as a fund family or corporate family, where the source names the group rather than one company.
- Two of those matches are organizations the census already counted, so each is now counted once. A notice’s “Regence” is Regence BlueCross BlueShield of Utah, and its “Wellpoint” is the Anthem / Elevance Health family. That is why data owners and intermediaries fell from 1,720 to 1,718 and the total from 1,877 to 1,875.
- 67 named units stay provisional, with the evidence that would settle each one recorded. For 49, two or more organizations share the name and the source doesn’t say which one it means, for example a college name used in several states. The other 18 can’t be identified from what the sources say yet.
The census of 26 October stays as it was published.
What counts as an organization here
- A unit is an organization matched to one identity, or, where a source names it in a way that can’t yet be matched, a provisional unit tied to that source, incident and role.
- Included: data owners and intermediaries that a source places in the incident, even when the name can’t yet be matched to a company, and 6 unnamed intermediaries that sources describe.
- Excluded: names that appear without a role in the incident, unsupported leads, and labels that only assemble a count.
- A family relationship alone does not merge companies. Separately identified organizations stay separate until evidence shows they are the same counting unit.
- Being in the census changes no exposure count.
Not yet a count of unique companies
73 units are provisional, still being matched to a legal entity: 67 named data owners and intermediaries and 6 unnamed intermediaries. Some may turn out to be an organization already counted, so the total can move down as well as up. Units matched to a group of organizations can also overlap companies counted on their own. The census is not a count of unique legal entities or of parent companies.
Why the total is 1,875, not 1,876
The census itself holds 1,876 units, including 170 custodian units. The 170th is Bank of America’s engagement with EY, which the custodian list counts under EY (US), and Bank of America is already counted among the data owners. The homepage uses the list’s 169 custodians with the census’s 1,718 and 12, so the parts add up to the total shown.
The record
Census BG_MOVEIT_ORG_CENSUS_20261028_001 (version 11), captured 28 October 2026, with custodian list MOVEIT_BSC_LIST_20261026_004. It replaces census BG_MOVEIT_ORG_CENSUS_20261026_001: 330 units changed (2 of them folded into units already counted) and the other 1,548 are carried over unchanged. Every unit is tied to the source occurrences that name it, and every match to the identity review behind it.
How to cite this census
BreachGraph (Torgen Inc.), “MOVEit 2023 organization census,” BG_MOVEIT_ORG_CENSUS_20261028_001, 28 October 2026, https://breachgraph.net/releases/moveit-census-2026-10-28.
What vetted reviewers can see
The unit list, the source behind each unit, the evidence for each match, and the matches still open. Request access.
Corrections
Know an organization we missed, two we count separately that are the same, or which of the candidates a provisional name means? Send it to tips at torgen.us and we’ll review it. Accepted corrections go into the next census.