MOVEit Data Breach Settlements You Can Still Claim in 2026
Last updated August 22, 2026 · By Class Action Buddy
Short answer: The 2023 MOVEit breach exposed the personal data of tens of millions of people through the 2,500-plus organizations that used the software. Many of those companies have reached class action settlements, and several are still open for claims in 2026 — often paying cash plus free credit monitoring, sometimes with no proof required.
Key point: Because so many organizations used MOVEit, you can be a class member in several settlements at once. Check every breach notice you received.
In the summer of 2023, one flaw in one piece of software turned into one of the largest data breaches ever recorded. The tool was MOVEit Transfer, a file-transfer program that thousands of organizations — banks, insurers, hospitals, universities, government agencies, payroll firms — used to shuttle sensitive files around. In May 2023 a ransomware group called Clop found a hole in it and quietly siphoned data out of company after company. No ransom, no locked files, just theft. By the time the scope was clear, more than 2,500 organizations had been hit and the personal information of tens of millions of people — reported estimates run from roughly 60 million to over 90 million — was gone.
Here is the part that matters if you are reading this in 2026: you may be owed money, and you might not know it.
Because so many organizations ran MOVEit, the breach spawned a wave of separate class action settlements — roughly one for each company whose data got taken — and a number of them are still open for claims. Many pay cash plus free credit monitoring. Some require no proof at all. This guide covers what the MOVEit breach was, why there are so many settlements, what they typically pay, and how to find and claim the ones you qualify for before the deadlines pass.
What was the MOVEit data breach?
MOVEit Transfer is a piece of "managed file transfer" software made by Progress Software. Organizations use it to move large, sensitive files — payroll records, insurance data, medical files, government filings — between systems and partners. In May 2023, the Clop ransomware group discovered and exploited a previously unknown flaw (a zero-day SQL-injection vulnerability) in MOVEit and used it to quietly copy data out of any organization running the software.
The scale was staggering. Security researchers have tied the attack to more than 2,500 organizations, and reported estimates of the number of affected individuals range from roughly 60 million to over 90 million worldwide. Unusually, the attackers did not lock up files or demand a per-company ransom in the usual way; the operation was pure data theft and extortion.
Why there are so many separate MOVEit settlements
Here is the key thing to understand: the breach did not just expose Progress Software's own data. It exposed data held by the hundreds of banks, insurers, hospitals, universities, pension funds, and payroll providers that used MOVEit to handle their customers' and employees' information. Each of those organizations is potentially responsible for protecting the data it held, so the breach produced a wave of separate class action lawsuits and settlements — often one or more for each affected company.
That means a single person can be a class member in several different MOVEit settlements at once, depending on which companies held their data. If your bank, your former employer's payroll provider, and your insurer all used MOVEit, you could have three separate claims to file.
What MOVEit settlements typically pay
Data-breach settlements tend to follow a similar structure, and MOVEit settlements are no exception. Most offer some combination of the following:
- Reimbursement for documented out-of-pocket losses — bank fees, credit-freeze costs, or expenses from identity theft fairly traceable to the breach — usually up to a cap (often somewhere between $2,500 and $10,000) and requiring receipts or statements.
- A flat "alternative" cash payment for people without documented losses, typically a smaller amount (often in the range of $25 to $100) that may be adjusted up or down depending on how many people file.
- Free credit monitoring and identity-theft insurance, which usually requires no proof at all.
The exact amounts vary by settlement, and the flat cash payment is often "pro rata," meaning it shrinks if a lot of people claim. Always check the official settlement website for the specific numbers.
MOVEit settlements open for claims now
Several MOVEit-related settlements are open for claims in 2026. For example, the Ernst & Young / Bank of America MOVEit settlement and the GRIPA MOVEit data breach settlement are both accepting claims. You can browse the full, current list on our settlements page, which tracks deadlines so you do not miss one.
How to find out if you were affected — and claim
If your data was caught up in the MOVEit breach, the affected company was generally required to mail or email you a breach notice. Those notices are your best clue to which settlements you qualify for. To claim safely:
- Keep any breach-notice letters or emails you received in 2023 or later; they usually name the settlement and include a claim ID.
- File on the official settlement website named in your notice, before the claim deadline.
- Be alert to scams: a legitimate data-breach settlement never asks you to pay a fee or hand over your bank password to "release" your money.
Frequently Asked Questions
How do I know if I was affected by the MOVEit breach?
The company that held your data was generally required to notify you by mail or email. If you received a data-breach notice from a bank, insurer, employer, or other organization in 2023 or later that mentioned MOVEit or Progress Software, you were likely affected.
How much can I get from a MOVEit settlement?
It varies by settlement. Most pay reimbursement for documented losses up to a cap, plus a smaller flat cash payment (often $25 to $100) for those without documentation, and free credit monitoring. The flat payment is usually pro-rata, so it can shrink if many people file.
Do I need proof to file a MOVEit claim?
For the flat cash payment and credit monitoring, usually no. Proof such as receipts or statements is typically required only if you claim reimbursement for specific out-of-pocket losses.
Can I file more than one MOVEit claim?
Yes. Because many organizations used MOVEit, your data may have been exposed through several of them, and each may have its own settlement. You can file a claim in every settlement you qualify for.
Is it too late to claim?
Some MOVEit settlements have closed, but others are still open in 2026. Check the official settlement site for each one's deadline, or see our settlements page for currently open data-breach claims.
The MOVEit breach was unusual in its reach, and the settlements it produced are unusual in number. If you received a breach notice in the last couple of years, it is worth a few minutes to check whether one of these settlements owes you cash and free credit monitoring.
Class Action Buddy tracks open data-breach settlements and their deadlines so you can claim what you qualify for without missing a date.
Start Filing Claims in 60 Seconds
Class Action Buddy auto-fills your claim forms and tracks every deadline. Your first claim is free.
