Conduent data breach impacts millions

Conduent Business Solutions LLC, a large government contractor and business associate to healthcare entities, disclosed a multi-million-record data breach to state regulators across the country.

Conduent provides back-end processing, printing and payments services to healthcare organizations, insurance companies, state agencies and other organizations.

According to an April 2025 Securities and Exchange Commission (SEC) filing, Conduent experienced an operational disruption beginning Jan. 13, 2025, and immediately launched an investigation.

Conduent said it restored normal operations within days. However, the investigation revealed that a cyberthreat actor had exfiltrated files containing the personal information of a "significant number" of Conduent clients and their end users.

The unauthorized party maintained access to Conduent systems from Oct. 21, 2024, to Jan. 13, 2025.

As a result of the cyberattack, Conduent said in the SEC filing that it had incurred approximately $25 million in direct response costs.

The final breach tally has not been posted to the Office for Civil Rights breach portal, likely due to the ongoing government shutdown. However, several state regulators have received breach reports, and some organizations have published their own breach notifications.

For example, the Texas attorney general's office website indicates that more than 4 million Texans were impacted by the breach. What's more, more than 1 million people in Oregon and 200,000 in Montana were affected.

Several insurers have posted breach notices, including Blue Cross and Blue Shield of Montana and Premera Blue Cross in Washington. The breach is shaping up to be the largest reported in 2025, so far, ahead of Yale New Haven Health's March 2025 hack.