MOVEit hack victim list

Total: 2611

Bank: 1

Unknown country

Company/Organization: 4

Oil and gas: 1

Technology: 1

Unknown country total: 6

Australia

Auditor: 1

Facility management: 1

Gaming technology: 1

Health insurance: 1

Mining: 1

Oil and gas: 1

Australia total: 6

Austria

Bank: 1

Company: 2

Financial Market Authority: 1

Austria total: 4

Belgium

Automotive supplier: 1

Belgium total: 1

Bermuda

Company: 1

Insurance: 1

Bermuda total: 2

Brazil

Insurance: 1

Brazil total: 1

Canada

Company/Organization: 7

Administrative entity: 1

Association: 1

Bank: 1

Communication technology: 1

Construction regulatory authority: 1

Engineering: 1

Furnishing chain: 1

Government: 9

Health care system: 5

Health insurance: 1

Health promotion: 1

Healthcare: 102

Hospital: 9

Insurance: 3

Law firm: 1

Medical center: 1

Mining: 1

Pension plan: 1

Police agency: 1

School board: 1

Software: 1

Tax authority: 1

Water utility: 1

Canada total: 153

China

Bank: 1

Electronic products: 1

China total: 2

Denmark

Mechanical engineering: 1

Denmark total: 1

Finland

Technology: 1

Finland total: 1

France

Electrical technology: 1

Healthcare: 1

IT service provider: 1

Laboratory: 1

Railway company: 1

France total: 5

Germany

Association of statutory health insurers: 1

Automotive supplier: 2

Bank: 8

Bonus program: 1

Company: 1

Comparison Shopping Website: 1

Energy technology: 1

Health insurance: 1

Insurance: 5

Logistics: 1

Logistics solutions: 1

Manufacturer: 1

Mechanical engineering: 1

Media company: 1

Printing machines: 2

Publishing company: 1

Service provider - customer contact management: 1

Statutory health insurance: 8

Technology: 2

Germany total: 40

Guatemala

Bank: 1

Guatemala total: 1

India

Automotive supplier: 1

Diversified group: 1

Insurance: 1

India total: 3

Ireland

Airline: 1

Airport operator: 1

Gambling company: 1

Health Department: 1

Packaging manufacturer: 1

Regulatory authority: 1

Ireland total: 6

Israel

Company: 1

Israel total: 1

Italy

Accessories manufacturer: 1

Italy total: 1

Japan

Electronics Group: 1

Printing machines: 1

Japan total: 2

Luxembourg

Company: 1

Luxembourg total: 1

Malaysia

Insurance: 2

IT service provider: 1

Malaysia total: 3

Netherlands

Company: 1

Health data: 1

Information services: 1

IT service provider: 1

Petroleum company: 1

Plant engineering: 1

Power grid operator: 1

Software: 1

Travel management: 1

Vacation parks: 1

Netherlands total: 10

Norway

Debt collection company: 1

Norway total: 1

Oman

Oil and gas: 1

Oman total: 1

Philippines

Bank: 1

Drink producer: 1

Philippines total: 2

Puerto Rico

Bank: 1

University: 9

Puerto Rico total: 10

South Africa

Pharmacy chain: 1

South Africa total: 1

Spain

IT service provider: 1

Spain total: 1

Sweden

Insurance: 1

Receivables management: 1

Sweden total: 2

Switzerland

Automotive supplier: 1

Company: 2

Health insurance: 1

Insurance: 1

IT service provider: 1

IT wholesaler: 1

Pharmaceutical company: 1

Tobacco manufacturer: 1

Switzerland total: 9

Turkey

Aerospace: 1

Manufacturer: 1

Turkey total: 2

UAE

Shipyard: 1

UAE total: 1

United Kingdom

Airline: 1

Artificial intelligence: 1

Auditors: 1

Broadcaster: 1

Communications service provider: 1

Consulting: 1

County council: 1

Health and beauty products: 1

HR and payroll systems: 1

Insurance: 1

IT service provider: 2

Logistics: 1

Mechanical engineering: 1

Media / publishing company: 1

Oil and gas: 1

Outsourcing company: 1

Pension plan: 1

Printing and security solutions: 1

Regulatory Authority: 1

Risk management: 1

Service provider: 1

Software vendor: 1

Toll accounting: 1

Vacation apartments: 1

United Kingdom total: 25

USA

Company/Organization: 320

Academy: 4

Accounting: 1

Accounting and consulting company: 1

Agency: 2

Airline: 2

Artificial intelligence: 1

Automation technology: 1

Automotive supplier: 3

Bank: 117

Beauty products: 2

Beverage logistics: 1

Biotech: 3

Bus manufacturer: 1

Care insurance: 1

Casting: 1

Charter schools: 1

Chemical company: 2

Church: 2

Cinema operator: 1

College: 265

College system: 2

Communication technology: 1

Community College: 188

Community college district: 3

Community College System: 1

Company: 7

Consortium of universities: 1

Construction company: 1

Construction materials: 1

Consulting: 3

Consumer organization: 1

County government: 4

Credit union: 19

Credit union service provider: 1

Data service provider: 1

Design and architecture: 1

Diagnostics: 1

Donation management: 1

Economic development: 1

Elderly care service: 2

Electronic products: 3

Electronics: 1

Electronics wholesaler: 1

Emergency service: 19

Energy company: 1

Energy supply: 6

Engineering company: 1

Entertainment industry: 1

Financial service provider: 33

Financial services provider: 1

FinTech: 2

FinTech company: 2

Furniture components: 1

Government: 17

Health care provider: 1

Health care system: 16

Health Department: 2

Health insurance: 28

Health insurer: 1

Health organization: 1

Health plan: 8

Healthcare: 78

Healthcare organizations in North Carolina: 14

High School: 13

Hotel group: 1

Household appliances manufacturer: 1

Information services company: 1

Institute: 13

Insurance: 68

Insurance company: 1

Investment company: 6

IT service provider: 13

Labeling solutions: 1

Law firm: 3

Law school: 2

Lighting manufacturer: 1

Lighting systems: 1

Logistics: 2

Logistics solutions: 1

Market research: 1

Marketing: 4

Mechanical engineering: 3

Media: 1

Medical association: 1

Medical equipment: 2

Medical school: 3

Metallurgy: 1

Military school: 1

Mining: 3

Network technology provider: 1

Newspaper: 1

Nonprofit organization: 1

Oil and gas: 3

Online game provider: 1

OrthoNebraska: 1

Packaging manufacturer: 1

Payment provider: 2

Payroll services: 1

Pension plan: 11

Performance rights organisation: 1

Pharmaceutical company: 2

Pharmacy chain: 2

Photo service provider: 1

Physicians association: 2

Platform: 1

Printing machines: 1

Radioactive waste repository: 1

Railway company: 1

Receivables management: 3

Research: 2

Restaurant chain: 1

Retail chain: 4

School: 9

School board: 1

School district: 2

Secondary School: 1

Seminary: 4

Service provider: 12

Service provider - finance: 9

Service provider - healthcare: 4

Service provider for financial companies: 1

Shipping company: 1

Social services: 2

Software: 20

Steel producer: 1

Student registry: 1

Talent management: 1

Technology: 7

Telecommunications provider: 1

Temporary employment: 1

Timesharing: 1

Translation company: 1

Travel Management: 1

TV station: 1

U.S. companies: 371

University: 441

University hospital: 1

University system: 5

US State: 1

Wholesaler: 1

USA total: 2305

• MOVEit is software and a registered trademark of Progress Software Corporation.

• Progress Software has provided extensive information on the vulnerability and its fix, see MOVEit Transfer and MOVEit Cloud Vulnerability

• This overview is not intended to put anyone in the pillory. Rather, it was created to raise awareness of IT security at all steps of the value chains in our interconnected world. In addition, there seems to be a great deal of public interest in the topic, and the list aims to compile verifiable facts and thus create clarity.

• KonBriefing thinks: Today's IT systems have a very high level of complexity. This means that vulnerabilities in software cannot be completely avoided, even with the greatest diligence. In addition to traditional IT security, we therefore need concepts to ensure that the effects of such vulnerabilities do not reach these dimensions in future. This includes data economy, so that at neuralgic points such as interfaces, only data is available that is actually needed at that point in time.

• Sources: The list is compiled from the following sources
  Leak list, publications by affected companies and organizations, privacy incident reports filed with U.S. states (where published), reports filed with the U.S. Securities and Exchange Commission, reports in the media

• Unconfirmed organziations: So far unconfirmed victims and victims with no media coverage yet have a question mark. They are shown without name and without exact location.

• U.S. colleges and universities listed here generally do not yet have accurate information on whether and to what extent they are affected via NSC, TIAA, or Corebridge. Therefore, the exact status for them is currently "presumably affected".

• Overlapping notifications: There could be overlaps in the numbers of affected individuals. Example: It is unclear whether the 1,500 individuals reported for Rhode Island Government through TIAA/PBI are not already included in the 2,630,717 total individuals reported for TIAA.

• Multiple affected persons: Individuals may be affected by multiple incidents at the same time - they are counted multiple times here. Example: A person from Nova Scotia is affected as a teacher (Nova Scotia Teachers) and as a customer of the water supply (Halifax Water). She is thus counted in both sets. Therefore, strictly speaking, the sum is not the total number of people affected, but the total number of people records affected.

• Timeline: Matt Kapko has created an extensive timeline on the MOVEit breach: Cybersecurity Dive: MOVEit mass exploit timeline: How the file-transfer service attacks entangled victims

• PBI Research → Banks
• NSC (National Student Clearinghouse) → Universities

• PBI → TIAA (Teachers Insurance and Annuity Association of America) → numerous universities
• ISCorp (cloud provider, USA) → Envision (software) → Pear Tree Advisors (software user)

• University of Utah (USA, via NSC and via PBI → TIAA and via TIAA Kaspick)
• Umpqua Bank (USA, via service provider and own installation / on-premises)