MOVEit Data Breach Litigation: MDL 3083 Status

The MOVEit data breach litigation is centralized in a federal multidistrict proceeding in Massachusetts, MDL No. 3083, In re: MOVEit Customer Data Security Breach Litigation. The Judicial Panel on Multidistrict Litigation created the MDL on October 4, 2023 and assigned it to Judge Allison D. Burroughs of the District of Massachusetts. The claims arise from the exploitation of a vulnerability in Progress Software’s MOVEit Transfer file transfer product in 2023. The JPML’s statistics report of October 1, 2026 lists 233 actions pending in the docket, of 349 filed since it began. The court has dismissed part of the bellwether claims at the pleading stage and dismissed cases filed before August 15, 2023 for lack of standing. In the documents reviewed for this article, no trial date, no certified class and no approved settlement appears.

The breach the cases describe

The joint advisory that the FBI and the Cybersecurity and Infrastructure Security Agency published, and updated on June 16, 2023, describes the campaign. According to that advisory, the CL0P ransomware group, also tracked as TA505, began exploiting a previously unknown SQL injection vulnerability in MOVEit Transfer on May 27, 2023. The vulnerability is catalogued as CVE-2023-34362. The attackers installed a web shell named LEMURLOOT on internet-facing MOVEit Transfer servers and used it to steal data from the underlying databases. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 2, 2023. The advisory lists affected versions from MOVEit Transfer 2020.0.x through 2023.0.0.

The JPML’s transfer order describes the same events from the litigation’s perspective. It records that on May 31, 2023 Progress posted a notice on its website stating that it had discovered an SQL injection vulnerability in its MOVEit file transfer services and a related breach in its network and systems. The order states that the vulnerability was alleged to have been exploited by a Russian cybergang in May 2023, and that the breach was, in the order’s words, “estimated to have compromised the personally identifying information (PII) of over 55 million people.” The plaintiffs are individuals whose personal information was potentially compromised, bringing largely overlapping putative nationwide or statewide class actions.

What is established vs. what is alleged

Established: the vulnerability and its exploitation, as a federal agency documented them in a dated advisory; the creation of MDL No. 3083 in the District of Massachusetts on October 4, 2023 and the assignment to Judge Burroughs; the counts the court dismissed and the counts it allowed to proceed in its bellwether rulings; and the dismissal of certain cases for lack of standing.

Alleged, not decided: that Progress Software or any other defendant failed to safeguard the plaintiffs’ personal information, and that any plaintiff’s harm is traceable to that failure. The court’s orders decide which allegations are sufficient to proceed. They are not findings that the allegations are true. No court has found any defendant liable.

Who the defendants are

The transfer order describes defendants in groups: Progress Software Corporation, which owns the MOVEit software and is headquartered in Burlington, Massachusetts, and, in varying combinations, direct users of the software and companies that did business with those users. It records that Progress and Ipswitch, Pension Benefit Information, Athene Annuity and Life Company, F&G Annuities & Life, Genworth Financial, Milliman, and Union Bank and Trust Company supported centralization, and that Fidelity Investments Institutional Operations Company and FMR LLC did not oppose it. The later rulings refer to bellwether groups: the Progress bellwether cases, direct-user defendants such as Pension Benefit Information and Milliman, and vendor contracting entity defendants such as Maximus, Welltok, Corewell Health, Sutter Health, OSF Healthcare System, CHI Health - NE and Virginia Mason Franciscan Health.

Where the claims stand procedurally

MDL No. 3083 is in pretrial proceedings on the master docket 1:23-md-03083-ADB-PGL. The court has worked through the defendants’ threshold motions in stages.

On December 12, 2024, MDL Order No. 19 granted in part and denied in part the defendants’ motion to dismiss for lack of Article III standing. The court dismissed four individual cases for lack of traceable injury, naming Harris, Oakwood, Newman and O’Neal, and dismissed requests for injunctive relief in a list of cases appended to the order.

On July 31, 2025, the court ruled on the first bellwether motions to dismiss for failure to state a claim. MDL Order No. 22 granted Progress Software’s motion on many counts, including several negligence, contract and statutory counts, granted it in part on Counts 1, 4 and 18, and otherwise denied it. MDL Order No. 23 resolved the corresponding motions by the direct-user and vendor contracting entity defendants, dismissing large groups of counts against each while allowing others, including several negligence and declaratory judgment counts, to proceed. Orders Nos. 24, 25, 27, 28 and 29, issued between October 2025 and January 2026, resolved motions to reconsider or amend those two rulings.

On February 6, 2026, MDL Order No. 32 dismissed every case consolidated into the MDL that had been filed before August 15, 2023, the date the plaintiffs allege the group began disclosing stolen data. The court held that a plaintiff who filed before that date cannot plausibly allege either actual misuse or a substantial risk of future harm. On April 22, 2026, MDL Order No. 33 held that supplemental pleadings may cure that filing-date defect for the cases the parties marked in yellow, and those cases remain consolidated.

Discovery has continued through 2026. MDL Order No. 34, dated May 8, 2026, resolved a motion to compel discovery from vendor contracting entity defendants about their own cybersecurity practices. MDL Order No. 37, dated June 26, 2026, declined to apply the economic loss doctrine to dismiss the bellwether plaintiffs’ negligence claims at that stage, while leaving the issue open for later briefing. MDL Order No. 38, dated August 25, 2026, granted a protective order over one bellwether plaintiff’s medical and mental health records.

Within the documents reviewed for this article, the court has not certified a litigation class and has not set a trial date.

Key dates

• May 27, 2023: the CL0P group begins exploiting CVE-2023-34362 in MOVEit Transfer (FBI and CISA advisory).
• May 31, 2023: Progress posts notice of the SQL injection vulnerability and a related breach on its website (JPML transfer order).
• June 2, 2023: CISA adds CVE-2023-34362 to its Known Exploited Vulnerabilities catalog (FBI and CISA advisory).
• October 4, 2023: the JPML creates MDL No. 3083 in the District of Massachusetts and assigns it to Judge Burroughs (JPML transfer order).
• December 12, 2024: MDL Order No. 19 decides the standing motion in part and dismisses four individual cases (District of Massachusetts).
• July 31, 2025: MDL Orders Nos. 22 and 23 decide the first bellwether motions to dismiss (District of Massachusetts).
• February 6, 2026: MDL Order No. 32 dismisses all cases filed before August 15, 2023 for lack of standing (District of Massachusetts).
• April 22, 2026: MDL Order No. 33 allows supplemental pleadings to cure the filing-date defect (District of Massachusetts).
• August 25, 2026: MDL Order No. 38 rules on discovery over a bellwether plaintiff’s records (District of Massachusetts).
• October 1, 2026: the JPML’s statistics report lists 233 actions pending of 349 filed (JPML).

What this does not establish

The record reviewed here does not show that any court has determined that Progress Software, or any other defendant, caused any person’s harm, or that any defendant admitted wrongdoing. It does not show that a class has been certified, that a settlement has been announced or approved, or that a trial date has been set. A dismissal for failure to state a claim is a ruling about the sufficiency of a complaint, not a finding about the facts, and the parties may replead. The figure of more than 55 million affected people comes from the JPML transfer order’s description of the allegations at the time of centralization, not from an audited count. A data breach does not by itself establish that any particular person is entitled to compensation, and the outcome of any individual claim depends on that person’s facts. Notices about settlements in data breach matters circulate widely; our guide to verifying settlement notices explains how to check one against a court record.

Frequently asked questions

Is the MOVEit litigation a class action?

The cases began as putative class actions, and the operative bellwether pleading is the Corrected Bellwether Consolidated Class Action Amended Complaint described in MDL Orders Nos. 22 and 23. Those are allegations on behalf of proposed classes. No class has been certified in the documents reviewed here, so no one is currently a class member by virtue of a court order.

Has there been a settlement in the MOVEit litigation?

No settlement announcement or approval appears in the court orders and statistics reviewed for this article. The docket remains in pretrial proceedings, with discovery disputes and reconsideration motions decided through August 2026.

What is CVE-2023-34362?

It is the identifier for the SQL injection vulnerability in MOVEit Transfer that the CL0P group exploited from late May 2023, as described in the advisory that the FBI and CISA published. CISA added it to its catalog of vulnerabilities known to be exploited in the wild on June 2, 2023.

Does the breach mean I have a valid claim?

Whether any person can recover depends on facts specific to that person, including whether their information was exposed and what harm they can show. Under MDL Order No. 32, cases filed before August 15, 2023 were dismissed for lack of standing, which shows that the timing and content of a filing can matter. That ruling is not legal advice, and anyone with questions about their own situation should consult a licensed attorney. For the general structure of this kind of proceeding, see our explainer on MDL versus class action and our outline of how mass tort litigation works; the Class Actions category includes related coverage such as Roblox child safety claims.

Sources

1. United States Judicial Panel on Multidistrict Litigation: “In re: MOVEit Customer Data Security Breach Litigation, MDL No. 3083, Transfer Order (Oct. 4, 2023)” (link, accessed 2026-10-17)
2. Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation: “#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A, updated June 16, 2023)” (link, accessed 2026-10-17)
3. United States Judicial Panel on Multidistrict Litigation: “MDL Statistics Report: Distribution of Pending MDL Dockets by District (Oct. 1, 2026)” (link, accessed 2026-10-17)
4. U.S. District Court for the District of Massachusetts: “MDL Order No. 19: Order on Defendants’ Rule 12(b)(1) Motion to Dismiss for Lack of Article III Standing (Dec. 12, 2024)” (link, accessed 2026-10-17)
5. U.S. District Court for the District of Massachusetts: “MDL Order No. 22: Progress Motion to Dismiss for Failure to State a Claim (July 31, 2025)” (link, accessed 2026-10-17)
6. U.S. District Court for the District of Massachusetts: “MDL Order No. 23: Direct User and VCE/VCEC Motions to Dismiss for Failure to State a Claim (July 31, 2025)” (link, accessed 2026-10-17)
7. U.S. District Court for the District of Massachusetts: “MDL Order No. 32: Regarding Additional Dismissal of Cases Filed Before August 15, 2023, for Lack of Article III Standing (Feb. 6, 2026)” (link, accessed 2026-10-17)
8. U.S. District Court for the District of Massachusetts: “MDL Order No. 33: Regarding Parties’ Joint Response to MDL Order No. 32 (Apr. 22, 2026)” (link, accessed 2026-10-17)
9. U.S. District Court for the District of Massachusetts: “MDL Order No. 37: Regarding the applicability of the economic loss doctrine to certain of Bellwether Plaintiffs’ negligence claims (June 26, 2026)” (link, accessed 2026-10-17)
10. U.S. District Court for the District of Massachusetts: “MDL Order No. 38: Regarding Bellwether Plaintiffs’ motion for a protective order (Aug. 25, 2026)” (link, accessed 2026-10-17)

CollectiveClaim.us publishes general legal information. This article is not legal advice and does not create an attorney–client relationship. Court records and agency actions change; verify current status with the court or agency before relying on it.