What Happened
MOVEit is a widely used managed file-transfer tool made by Progress Software. In May 2023, the Russia-linked Clop ransomware group exploited a previously unknown vulnerability in MOVEit to steal data from the many organizations that used it — banks, schools, government agencies, pension systems and payroll providers. Because so many institutions relied on the tool, one flaw cascaded into one of the largest breaches of the year.
Reporting has put the impact at more than 2,500 organizations and tens of millions of people — with some counts exceeding 60 million individuals — whose data included Social Security numbers, financial and even medical information.
The Litigation
Dozens of class actions followed against Progress Software and various organizations that used MOVEit, and they were consolidated into a multidistrict litigation. A Massachusetts federal court allowed bellwether negligence and consumer-protection claims to proceed past early dismissal motions — a meaningful step, since data-breach cases often stumble at the injury-and-standing stage.
The litigation is closely watched as a template for how mass third-party-software breaches are handled.
What Affected People Should Know
Many people were affected through an organization they dealt with rather than MOVEit itself, so a breach notice may name a bank, school or agency. Freeze credit if SSNs were exposed, use any offered monitoring, and keep the breach notice — it identifies which entity held your data and anchors a claim.
Before You Act
Thinking About Filing a Claim?
Most plaintiff lawyers offer a free initial consultation and work on contingency, meaning no fee unless there is a recovery. LawsuitWatch is not a law firm: we publish explainers, and we do not provide legal advice, representation or referrals. Your state bar directory is the reliable place to find and verify a lawyer.
MOVEit Data Breach Lawsuit: The 2023 Mass Hack: Frequently Asked Questions
Answers to the most common questions about this case and your legal options.
What was the MOVEit breach?
A May 2023 mass hack in which the Clop group exploited a vulnerability in Progress Software's MOVEit file-transfer tool to steal data from thousands of organizations, affecting tens of millions of people.
Who is being sued?
Progress Software and many organizations that used MOVEit, in dozens of class actions consolidated into a multidistrict litigation that has advanced past early dismissal.
How do I know if I was affected?
You would typically receive a breach notice from the organization that held your data (a bank, school or agency). Keep that notice; it identifies the entity and supports a claim.
Legal Disclaimer
This article is general legal information, not legal advice, and does not create an attorney-client relationship. Case status, eligibility criteria, and any amounts described are as reported at the date shown and may change. Consult a licensed attorney in your jurisdiction about your own situation.