CBIZ MOVEit Breach Settlement Proposed for 586,000 Victims
CBIZ Proposes $7.2M Settlement for 2023 MOVEit Data Breach
Impact Scope
People Affected
586000
Industries Affected
Geographic Impact
Related Entities
Full Report
Executive Summary
On October 30, 2026, a motion was filed for the preliminary approval of a $7.2 million class-action settlement between business services company CBIZ, Inc. and individuals impacted by a 2023 data breach. The breach stemmed from the exploitation of a zero-day vulnerability in Progress Software's MOVEit Transfer application by the CL0P ransomware group. The attack compromised the personal and health information of approximately 586,000 people. The proposed settlement, finalized on October 29, 2026, aims to compensate victims for financial losses and provide credit monitoring services, marking a significant step in the legal fallout from the widespread MOVEit hacking campaign.
Regulatory Details
The settlement is part of the nationwide MOVEit multidistrict litigation (MDL) consolidated in the U.S. District Court for the District of Massachusetts. The breach occurred between May 27 and May 31, 2023, when CL0P systematically exfiltrated data from hundreds of organizations globally using the MOVEit flaw.
If the court grants preliminary approval, the settlement fund will be used to compensate class members under the following terms:
- Ordinary Losses: Reimbursement up to $2,500 for documented out-of-pocket expenses, including up to $100 for lost time.
- Extraordinary Losses: Reimbursement up to $10,000 for documented, significant financial harm directly resulting from the breach.
- Alternative Cash Payment: A one-time cash payment of $100, which may be adjusted based on the total number of claims filed.
- Credit Monitoring: All claimants will be eligible for two years of free credit monitoring and identity theft protection services.
This settlement resolves claims specifically against CBIZ and does not constitute an admission of wrongdoing. The broader litigation against Progress Software, the developer of MOVEit, is still ongoing.
Affected Organizations
The direct victim organization is CBIZ, Inc., but the breach impacted the 586,000 individuals whose sensitive data, including personal and health information, was stored on CBIZ's compromised MOVEit server.
Impact Assessment
For CBIZ, the $7.2 million settlement represents a significant financial cost on top of the initial incident response and reputational damage. For the victims, the settlement provides a mechanism for financial recourse, although compensation for privacy loss is often difficult to quantify. The case is a prominent example of the long-tail legal and financial consequences that follow major data breaches, particularly those involving supply chain vulnerabilities like the one in MOVEit. It highlights the accountability organizations face for protecting the data entrusted to them, even when the breach originates from a third-party software flaw.
Enforcement & Penalties
The $7.2 million settlement serves as the primary penalty for CBIZ in this class-action lawsuit. The final amount distributed to each claimant will depend on the number of claims filed and the types of losses claimed. The court's approval is required before the settlement is finalized and the claims process can begin.
Compliance Guidance
This case serves as a critical reminder for organizations about third-party and supply chain risk management.
- Vendor Risk Management: Organizations must have a robust process for vetting the security of third-party software, especially for applications that handle sensitive data like MOVEit.
- Rapid Patching: When a critical vulnerability is announced, especially one with a known exploit, organizations must have a process to apply patches immediately. The MOVEit campaign demonstrated how quickly threat actors can weaponize a zero-day.
- Data Minimization: Organizations should regularly review and minimize the data stored on file transfer servers to reduce the potential impact of a breach.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Promptly applying security patches for third-party software like MOVEit is the most critical defense against zero-day exploitation.
Restrict Web-Based Content
Properly configuring firewalls and access controls to limit exposure of file transfer applications can reduce the attack surface.
D3FEND Defensive Countermeasures
The CBIZ data breach, originating from the MOVEit zero-day, underscores the absolute necessity of a rapid and robust software update process. For any organization using third-party software that handles sensitive data, especially internet-facing applications like MOVEit Transfer, security patches must be treated as a top priority. A formal patch management policy should be in place that defines service-level agreements (SLAs) for applying critical and zero-day patches. This process should include automated asset inventory to know exactly where the vulnerable software is deployed and a streamlined testing and deployment pipeline to push updates quickly without causing business disruption. The MOVEit campaign proved that sophisticated actors like CL0P can exploit a vulnerability at scale within hours of its discovery, leaving no time for delayed patching.
To detect a breach like the one that hit CBIZ, organizations should implement User Data Transfer Analysis focused on their file transfer platforms. This involves establishing a baseline of normal data flow for the MOVEit server. Security teams should know the typical volume, frequency, file types, and destinations of data transfers. The CL0P group's attack involved mass exfiltration of data. A data loss prevention (DLP) or network monitoring solution configured with rules to detect and alert on unusually large data transfers leaving the MOVEit server would have provided a strong signal of compromise. For example, an alert could be triggered if the volume of data exfiltrated in a 24-hour period exceeds the historical average by a significant margin, or if data is being transferred to an unknown or untrusted destination. This allows for detection of the exfiltration phase of the attack, even if the initial exploit was missed.
Timeline of Events
CL0P ransomware group begins exploiting MOVEit zero-day vulnerability, affecting CBIZ.
Litigation parties sign a term sheet for a settlement.
The final settlement agreement is signed.
A motion for preliminary approval of the $7.2 million settlement is filed in federal court.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.