MOVEit Data Breach: Who Was Hit and What to Do

The MOVEit attack did not target one company. It hit a file transfer tool used by thousands of organisations, so people received notices from companies they barely knew.

By Siddharth ShankarUpdated October 20, 2026

If you received a letter about a breach from a bank, pension provider, school or government office you barely deal with, there is a good chance it was linked to MOVEit. This was one of the biggest supply-chain data thefts on record.

How the attack worked

According to the CISA and FBI advisory, the CL0P group, also known as TA505, began exploiting a previously unknown SQL injection flaw, CVE-2023-34362, in Progress Software’s MOVEit Transfer in May 2023. It infected internet-facing MOVEit web applications with malware and used it to steal data from the underlying databases. MOVEit Transfer is a managed file transfer product, so organisations use it to send large files, often containing customer or employee data.

How big it became

As reported by Help Net Security on September 26, 2023, analysts at Emsisoft counted more than 2,000 victim organisations and over 60 million affected individuals. The victims were overwhelmingly in the US, and education made up about 51 percent of incidents in that analysis. The totals may overlap, because some people were exposed through more than one vendor, and the figures were expected to rise as organisations that serve other organisations filed notices.

Named examples in that report included the Better Outcomes Registry and Network in Ontario (health information of about 3.4 million people), the Oregon Department of Transportation (about 3.5 million Oregonians), the Nova Scotia government (more than 165,000 notification letters) and the National Student Clearinghouse.

Why you may have heard from a company you do not know

Many organisations hand data to a third party, such as a payroll, benefits, pension or student records provider. When that provider used MOVEit, your data sat in its systems, not your employer’s. That is why a notice may name an unfamiliar company.

What data was taken

The CISA page says data was stolen from MOVEit Transfer databases but does not list the data types, which varied by victim. Notices from affected organisations usually say what applies to you, and it often included names, addresses, dates of birth, and in some cases Social Security numbers or health information. Read yours closely.

What to do if you were notified

Why the notices came late

Organisations had to investigate which of their files had been copied, and then work out which people were in them. Some sent letters weeks or months after the attack. A late letter does not mean you were safe in the meantime, so act on it as soon as you read it, and keep it with your records in case problems appear later.

Questions worth asking the organisation

• Which of my details were in the files that were taken?
• Which vendor held my data, and why was it holding it?
• What protection are you offering, and for how long?

The lesson

You cannot see which tools your employer, school or bank uses. What you can do is limit what you give out and be ready to act. See what a data breach is and should you worry about an old data breach.