Roadmap

What you can use now, and what comes next

Last updated 21 October 2026

Each stage says what you’ll be able to do and how we’ll know it’s done. A stage gets a date only when the work behind it is scheduled. When a stage ships, it moves to Delivered with its date.

1. NowLive

   See the method on MOVEit

   Built from public filings and published reports.

   • The custody path on the homepage, from the server that was hit to the companies the breach notices name, with the regulator’s filing behind each step.
   • A fixed, citable MOVEit count release: 115,986,845 reported exposures, not unique people.
   • How other trackers count MOVEit, figure by figure, with what each one counts.
   • A sample vendor custody report, the MOVEit whitepaper and a two-page summary for press, by request.

2. November 2026Requests open

   Founding Analyst pilots

   Name the vendors, clients or campaigns you need to investigate. We send back reviewed custody reports, delivered by hand, and while your pilot runs we send weekly updates when a new filing or leak-site listing touches a company you named. A vendor custody report is $149 and a client exposure check is $299; the $49 scoping call counts toward your first report. See the pilot terms.

   Done whenthe first pilot reports are delivered on agreed scope.

3. Early 2027Planned

   Self-serve MOVEit and Cl0p beta

   Sign in, look up a company, see its custody paths with the filing behind each step, and export a brief. At a Founding Analyst price of $49 a month, for vetted professionals doing defensive work.

   Done whenan analyst outside BreachGraph can go from a company name to its custody paths, their filings and an exported brief without our help, and each person’s access can be granted and withdrawn.

4. NextPlanned · not yet dated

   More in self-serve, plus monitoring

   Pilot reports can already cover any vendor or campaign you name. This stage brings more of that coverage into self-serve:

   • Cl0p’s other campaigns, including Oracle E-Business Suite and PTC Windchill.
   • The ten largest U.S. health-data breaches outside Cl0p’s campaigns.
   • Testing links between breaches and the fraud cases that may use their data, starting with Medicare equipment fraud.
   • Alerts when a new filing, leak-site post or court record touches a company you watch.
   • An API, and exports within your license.

   We’ll date this stage once we’ve measured how fast reviewed evidence keeps pace with new filings. How fast new records reach us is already measured, source by source, on the sources page. Founding Analysts’ cases set the order of work within it.

   Done wheneach item is available to subscribers, with the evidence behind each finding shown and inferred steps marked, as in the MOVEit work.

Delivered

• 21 Oct 2026Sources and freshness: every source we collect, how often we check it and when a check last succeeded, with measured leak-site capture speed.
• 21 Oct 2026breachgraph.net launched, with pilot requests, the pilot terms and how we handle your case.
• 19 Oct 2026MOVEit count release MOVEIT_COUNT_RELEASE_20261019_002.
• 9 Oct 2026Scheduled collection verified for the HHS breach portal and the California and Washington breach registers.
• 14 Sep 2026SEC filing and ransomware leak-site collectors started.

How this page works

If a date moves, we change it here and say so. Research appears only after it has been tested against past campaigns. Need something that isn’t listed? Name it when you request early access.