Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Maximus

Disclosed Jul 26, 20239,179,390 affectedConfirmed

Official notice

MOVEit breach exposes personal and health data of 8 to 11 million people

US government services contractor Maximus told the SEC that files taken from its MOVEit environment contained Social Security numbers, protected health information or other personal data of at least 8 to 11 million individuals. It booked about $15 million in expected investigation and remediation costs.

What is known

People affected9,179,390 (as reported to HHS)
DisclosedJul 26, 2023
DiscoveredMay 30, 2023
HappenedMay 30, 2023
AttackSupply chain
Data exposedNamesSocial Security numbersHealthOther
SectorGovernment · US
StatusConfirmed
Part ofMoveit (2023)

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: Maximus
Official noticeatg.wa.gov
Washington Attorney General breach notice: Maximus
Official noticeattorneygeneral.delaware.gov
Notice letter filed with the Delaware DOJ: Maximus
Official noticejustice.oregon.gov
Oregon DOJ breach notice: Maximus
Newsbleepingcomputer.com
8 million people hit by data breach at US govt contractor Maximus
SEC filingsec.gov
Maximus Form 8-K (July 26, 2023)
Regulatoroag.ca.gov
California AG breach notice: Maximus, Inc and its subsidiaries
Official noticein.gov
Indiana Attorney General 2023 data breach report: Maximus
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): Maximus (Business Associate, VA)

Notices filed

TotalJul 26, 2023
Research8,000,000 people
TotalAug 4, 2023
HHS archive9,179,390 people
Residents of CAAug 18, 2023
California AGCount not stated
Residents of INAug 24, 2023
Indiana AG40,470 people
Residents of WAAug 25, 2023
Washington AG70,847 people
Residents of DEAug 25, 2023
Delaware DOJ14,158 people
Residents of ORAug 29, 2023
Oregon DOJCount not stated

Same campaign

AmazonVendor breach exposed names, emails, phone numbers and employment records.Vendor breachRetailUSUnverifiedNov 11, 2024AutoZoneMOVEit breach exposes data of 184,995 AutoZone customers and staffSupply chain185K affectedRetailUSNov 20, 2023State of MaineMOVEit breach exposes data of 1.3 million people across Maine agenciesSupply chain1.3M affectedGovernmentUSNov 10, 2023University of MissouriMOVEit breach exposes University of Missouri personal dataSupply chain119K affectedEducationUSOct 20, 2023Flagstar BankFiserv MOVEit breach exposes 837,390 Flagstar customersVendor breach837K affectedFinanceUSOct 5, 2023Sony Interactive EntertainmentMOVEit zero-day exposes data of 6,791 Sony employees and relativesSupply chain6,791 affectedGamingUSOct 3, 2023BORN OntarioMOVEit breach exposes perinatal and child registry data of 3.4 millionSupply chain3.4M affectedHealthcareCAUnverifiedSep 25, 2023WelltokMOVEit server breach exposes data of 8.5 million US patientsSupply chain15M affectedHealthcareUSSep 22, 2023Cadence BankMOVEit zero-day used to steal Cadence Bank customer dataSupply chain14K affectedFinanceUSSep 15, 2023HoneywellMOVEit breach exposes pension plan participants' names and SSNsSupply chainManufacturingUSSep 13, 2023Pôle emploiProvider breach exposes names and social security numbers of French job seekersVendor breachGovernmentFRUnverifiedAug 25, 2023Colorado Department of Health Care Policy & FinancingIBM MOVEit breach exposes health data of 4.1 million Colorado Medicaid membersVendor breach4.1M affectedGovernmentUSAug 11, 2023TD AmeritradeMOVEit Transfer breach exposes TD Ameritrade client SSNs and account dataSupply chainFinanceUSAug 8, 2023Missouri Department of Social ServicesIBM MOVEit breach exposes Missouri Medicaid participants' dataVendor breach740K affectedGovernmentUSAug 7, 2023Radius Global SolutionsCollections firm Radius hit by MOVEit breach exposing consumer dataSupply chain632K affectedFinanceUSAug 4, 2023Garrett MotionMOVEit exploitation exposes Garrett Motion company, employee and customer dataSupply chainManufacturingCHAug 2, 2023SercoBenefits vendor CBIZ MOVEit breach exposes Serco US staff dataVendor breach10K affectedGovernmentUSAug 1, 2023Prudential FinancialPBI MOVEit breach exposes Prudential retirement payment recipientsVendor breachInsuranceUSJul 31, 2023Performance Health TechnologyMOVEit breach at health plan vendor exposes 1.7 million Oregon Health Plan membersSupply chain1.8M affectedHealthcareUSJul 31, 2023CareSourceMOVEit hack exposes CareSource members' health and personal dataSupply chain3.2M affectedHealthcareUSJul 27, 2023Pacific Premier BankTax compliance vendor's MOVEit breach exposes bank client dataVendor breachFinanceUSJul 25, 2023Johns Hopkins University and Health SystemMOVEit server breach at Johns Hopkins exposes personal informationSupply chainEducationUSJul 25, 2023Delta Dental of CaliforniaMOVEit breach exposes financial and card data of 6.9 million dental membersSupply chain7.1M affectedInsuranceUSJul 12, 2023Colorado State UniversityVendor MOVEit breaches expose Colorado State University student and staff dataVendor breachEducationUSJul 12, 2023Deutsche BankAccount switching provider breach exposes Deutsche Bank customer dataVendor breachFinanceDEUnverifiedJul 11, 20231st Source BankUnauthorized party accessed 1st Source Bank's MOVEit serverSupply chain450K affectedFinanceUSJul 10, 2023ShellSupply chain exposed names and employment records.Supply chainEnergyGBUnverifiedJul 6, 2023PlainsCapital BankCore banking vendor's MOVEit breach exposes nearly all PlainsCapital customersVendor breachFinanceUSJul 3, 2023TIAAVendor PBI MOVEit breach exposes TIAA participant dataVendor breachFinanceUSJun 30, 2023F&G Annuities & LifeVendor PBI MOVEit breach exposes data of many F&G policyholdersVendor breachInsuranceUSJun 30, 2023UCLASupply chain, data exposed not stated.Supply chainEducationUSUnverifiedJun 29, 2023Siemens EnergySupply chain, data exposed not stated.Supply chainEnergyDEUnverifiedJun 29, 2023National Student ClearinghouseMOVEit breach at student records nonprofit affects 890 schoolsSupply chainEducationUSJun 29, 2023Talcott ResolutionVendor PBI MOVEit breach exposes over half a million Talcott customersVendor breachInsuranceUSJun 27, 2023New York City Department of EducationMOVEit breach exposes data of about 45,000 NYC students and staffSupply chainEducationUSUnverifiedJun 26, 2023Jackson National Life InsuranceVendor PBI MOVEit breach exposes 700,000 to 800,000 Jackson customersVendor breach853K affectedInsuranceUSJun 26, 2023Corebridge FinancialVendor MOVEit breach exposes Corebridge customers' SSNs and policy numbersVendor breach6.5M affectedInsuranceUSJun 26, 2023Wilton ReassuranceVendor PBI MOVEit breach exposes 1.48 million insurance customersVendor breach1.5M affectedInsuranceUSJun 22, 2023Umpqua BankVendor and on-premise MOVEit breaches expose Umpqua customers' SSNsVendor breach429K affectedFinanceUSJun 22, 2023PBI Research ServicesMOVEit breach at pension death-audit vendor exposes millions of insurer customersSupply chainData brokersUSJun 22, 2023

Other breaches at Maximus

Insider breachInsider exposed names and health records. Reported to the HHS archive.4,955 affectedHealthcareUSApr 25, 2025Hacking breachHacking, data exposed not stated. Reported to the California AG.335K affectedGovernmentUSJun 18, 2021
History of this record
records_basis2026-09-25
organization to hhsby backfillSource
records2026-09-25
8000000 to 9179390by backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/D-BYear-to-Date-Report-2023.pdfby backfillSource
campaign2026-09-25
empty to moveit-2023by seedSource
sector2026-09-25
other to governmentby seedSource
attack2026-09-25
hacking to supply-chainby seedSource
data_types2026-09-25
["names"] to ["names","ssn","health","other"]by seedSource
records_basis2026-09-25
empty to organizationby seedSource
records2026-09-25
empty to 8000000by seedSource
disclosed2026-09-25
2023-08-18 to 2023-07-26by seedSource
summary2026-09-25
empty to US government services contractor Maximus told the SEC that files taken from its MOVEit environment contained Social Security numbers, protected health information or other personal data of at least 8 to 11 million individuals. It booked abby seedSource
title2026-09-25
empty to MOVEit breach exposes personal and health data of 8 to 11 million peopleby seedSource
data_types2026-09-25
[] to ["names"]by backfillSource
attack2026-09-25
unknown to hackingby backfillSource
discovered2026-09-25
empty to 2023-05-30by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Maximus