The MOVEit Breach Explained: What Actually Happened

If you received a letter this year saying your data was exposed because of “MOVEit,” you’re not alone — tens of millions of people got the same one, from customers of payroll providers, universities, government agencies, and healthcare companies that had never heard of each other.

What MOVEit actually is

MOVEit is file-transfer software that companies use behind the scenes to move sensitive files around — payroll records, health data, government forms. You never interacted with it directly. Your employer, insurer, or a vendor they used did.

What went wrong

A security flaw in MOVEit let attackers pull data directly out of the software without needing a password. A ransomware group exploited it at scale, hitting the software itself rather than any single company — which is why so many unrelated organizations were affected at once.

Why it matters even if you don’t recognize the company name

You often don’t get to choose which vendors your employer, bank, or school signs up with. This is the uncomfortable part of modern data exposure: a breach can happen three steps removed from you, at a company you’ve never heard of, and still put your information at risk.

What to actually do about it

• Take the notification letter seriously, even if the company name is unfamiliar — it usually names the specific data type exposed (SSNs, medical records, etc.), which tells you how urgent it is.
• Freeze your credit if Social Security numbers were involved — it’s free and it’s the single most effective step against identity theft.
• Change reused passwords. If any password tied to the exposed account is used elsewhere, that’s the bigger risk, not the original account itself.
• Watch for follow-up phishing. Breach data often gets reused months later in targeted scam emails that reference real details to seem legitimate.