Follow custody
Every exposure is attached to the breached-system custodian that ran the server, the data owners whose records were on it, and any intermediaries in between.
Data ownerIntermediaryBreached-system custodian
Evidence-based cyber+vendor risk intelligence: all-source, real-time, full-cycle.
BreachGraph answers the questions a breach leaves behind: Who ran the breached system? Whose data was exposed? Who paid? Trace a vendor’s breach to your clients, inspect the evidence behind every count, and hand over a brief you can defend. Early access Patent Pending
MOVEit is the proof.
BreachGraph's answers for the 2023 campaign, as of 20 October 2026.
-
Who ran the breached system?
164
breached-system custodians at moderate confidence or higher. The largest, PBI, accounts for 24,520,067 reported exposures.
-
Whose data was exposed?
115,986,845
reported exposures, reconciled by custody path so overlapping notices aren't counted twice. Each one links to its source.
-
Who paid?
8 of 9
class settlements so far are with the custodian that ran the breached server, not the data owner. The costs land there too: Maximus alone has recognized $35.2M in MOVEit incident charges since 2023. And 233 lawsuits are still pending in the federal MOVEit case.
In use
Five ways to put it to work
-
01Monitor emerging threats
Watch a live campaign, with every name weighed against its evidence
Replayed from Cl0p's 2026 PTC Windchill campaign: CISA listed the flaw as known-exploited on 25 June, extortion emails surfaced on 20 July, and 42 masked names were first seen on the leak site on 5 August, until Cl0p began revealing them on 12 August. BreachGraph rated each name against what the organization itself had disclosed: Philips at High, Fiserv as a claim only.
Replay of the 2026 campaign. Sources: PTC and CISA advisories, Ransom-ISAC reporting, Philips' disclosure, BreachGraph leak-site capture. Watchlist illustrative.
-
02Urgent impact report
Turn a new filing into a sourced client brief
A Maryland notice says PBI used MOVEit while processing data for NTT DATA on behalf of Standard Insurance. BreachGraph matches it to your client, lays out the custody path from The Standard through NTT DATA to PBI, separates what the evidence confirms from what is still open, and drafts the brief for your review.
Replay of a 24 Aug 2023 filing. Sources: Maryland AG notices ITU-373215 and ITU-372461, Maine AG filing. Clients illustrative.
-
03Portfolio triage
Find every client that reached a breached provider, even through another vendor
Check PBI against eight clients: four reached it, three of them only through another vendor. Routes that are inferred rather than stated in a filing are marked, with the reasoning one click away, so you know what each brief rests on.
Sources: Maryland, Maine, Indiana and Oregon AG filings. Portfolio illustrative.
-
04Vendor diligence
Check a vendor's breach record before you sign or renew
BreachGraph connects 1.69 million reported exposures across 13 FIS client populations to their source evidence. It also finds FIS in a second role, passing client data to PBI's MOVEit server (139,834 exposures, inferred), and turns both into questions to put to the vendor.
Sources: regulator filings, BreachGraph leak-site capture, Buckler exposure lists. Vendor list illustrative.
-
05Follow the aftermath
Follow a breach into court, regulators and settlements
Three years on, MOVEit is still producing consequences. Of 9 class settlements, 8 are with the custodian that ran the breached server; the ninth is with a data owner whose vendor ran it. In MOVEit so far, liability has followed custody, and BreachGraph tracks both.
Sources: MDL 3083 orders, settlement administrators, NYDFS, JPML docket report of 1 Oct 2026.
Method · Patent Pending
How BreachGraph counts
Public tallies such as Emsisoft’s MOVEit count warn that some people are counted more than once. BreachGraph reconciles reports by custody instead, so overlapping notices are not counted twice and separate breaches stay separate.
Count exposures, not people
Counts are reported exposures. Superseded and downstream-repeated counts are removed. Unique-person totals are never claimed, because no one can know them.
Emsisoft’s MOVEit tally reached 95,788,491 people as of 28 June 2024. BreachGraph’s 19 October 2026 release selects 115,986,845 exposures. The two use different cutoffs and counting units, so the gap is not a count of additional people.
Show the confidence
Each custodian carries a confidence level set by the evidence. Only moderate or higher enters campaign totals, and an attacker’s claim never raises confidence on its own.
- LowNamed on a leak siteShows: an attacker’s claim
- Low–moderatePlus an internet exposure scan of the vulnerable systemShows: the software was deployed
- ModeratePlus a breach notice (compromise), a patch disclosure (deployment) or a CISO termination (circumstantial)Shows: a compromise or deployment; the campaign link is inferred
- Moderate–highPlus an independent party naming its system as the one breached, such as a client's notice, a regulator record or a court filingShows: a compromise, named by someone else
- HighThe organization’s own disclosure of a compromise or containment tied to the campaign’s vulnerability, or that it ran the exploited software while notifying affected peopleShows: a compromise and the campaign link, in its own words
Evidence you can inspect
Check one custody path yourself
Two insurers’ customer data reached PBI’s MOVEit server through the same administrator, illumifin. Every step below links to a regulator’s own public filing, so you can check it without an account.
Routes and count
-
Nassau Life and AnnuityillumifinPBI
71,228 counted
-
Washington NationalillumifinPBI
4,150 counted
-
Jackson National LifeNassau and CNAPBI
About 7,000 held at zero
71,2284,15075,378
selected exposures on the route through illumifin to PBI
- Adds zeroNassau also filed its own report of the same 71,228. Counting it again would give 146,606 and put Nassau’s customers in twice.
- Adds zeroThe state resident counts in these filings (Indiana 1,852 and 53, Maryland 936 and 23) are subsets of the totals above.
- Held at zeroAbout 7,000 Jackson National Life customers sit on the Nassau and CNA routes. They add nothing to the count until their overlap with populations already counted is resolved.
Filings behind each step
-
Nassau Life and Annuity reported 71,228 people affected.
Indiana Attorney General, 2023 breach report, p. 21, row 754 · same total in the Oregon DOJ breach register
-
Washington National reported 4,150 people affected.
Indiana Attorney General, 2023 breach report, p. 34, row 1191
-
illumifin administers policies for Nassau, and PBI performs research services for illumifin.
Nassau’s Maryland notice ITU-373248, 31 Aug 2023, p. 1
-
illumifin administers Washington National policies and subcontracts services to PBI, whose MOVEit server was accessed on 29 and 30 May 2023.
Washington National’s Maryland notice ITU-373045, 8 Aug 2023, pp. 1–2
-
PBI ran the breached server: it applied patches “as a user of that software.”
PBI’s Maryland notice ITU-372461, 10 Jul 2023 High
-
Nassau and CNA administer policies for Jackson National Life and provided Jackson customer data to PBI. About 7,000 Jackson customers were affected.
Jackson’s Maryland notice ITU-372957, August 2023 supplement, p. 9
As of the 19 October 2026 count release. Vetted reviewers can also see BreachGraph’s preserved copies, file hashes and the decision record behind this count.
Found an error in a count or a filing link? Send us the filing at tips at torgen.us and we’ll review it.
Who it's for
Built for people who have to defend every number
Independent consultants
Brief clients on vendor and fourth-party exposure with evidence they can check themselves.
Researchers
Work from reconciled counts and custody paths instead of re-summing press reports.
Journalists
Trace a figure to the filing behind it before it goes to print.
Vendor-risk and insurance teams
See a vendor's breach roles and their consequences before renewal or underwriting.
Founding Analysts
Pilots start in November
Name the vendors and clients you need to investigate. We send back reviewed custody reports: who ran the breached system, whose data passed through it, and the filing behind each step.
- What you get first
- Custody reports on the companies you name, starting with the MOVEit and Cl0p campaigns, and weekly updates when a new filing or leak-site listing touches one of them. Your questions decide what BreachGraph encodes next.
- After you send a request
- We review every request by hand. If BreachGraph covers your case, we offer a 30-minute scoping call. Founding Analysts pay a one-time $49 to book it, and it stays refundable until we both agree on scope, timing and budget.
- Then
- Self-serve access is planned for early 2027, at $49 a month.
BreachGraph is built for defenders. Access is licensed to vetted professionals doing defensive work, with limits on how much can be viewed or exported.