Conduent faces mounting financial losses from data breach

Conduent Business Solutions LLC is anticipating further financial losses than previously disclosed from a recent data breach, according to the company's latest Securities and Exchange Commission filing.

As previously reported, Conduent, a large government contractor and business associate to many healthcare entities, disclosed a multi-million-record breach. Victim organizations include several health insurers, including Blue Cross and Blue Shield of Montana and Premera Blue Cross in Washington.

Although the breach has yet to appear on the HHS Office for Civil Rights data breach portal, filings with state attorneys general offices indicate that this could be one of the largest breaches reported in 2025, so far.

The Texas attorney general's office website indicates that more than 4 million Texans were impacted by the breach, as well as more than 1 million people in Oregon and 200,000 in Montana.

An April 2025 SEC filing stated that Conduent experienced an operational disruption beginning Jan. 13, 2025, and restored normal operations within days. However, further investigation revealed that the intrusion began in October 2024. A cyberthreat actor maintained access and successfully exfiltrated files containing personal information until Conduent contained the breach in January.

As a result of the cyberattack, Conduent said in the April filing that it had incurred approximately $25 million in direct, non-recurring response costs.

However, its latest filing indicated that expenses resulting from the breach are continuing to impact the company.

Conduent said it made cash disbursements of $9 million through September 2025, and it expects to make an additional $16 million in cash disbursements by the end of the first quarter of 2026 to cover notification requirements.

Conduent anticipates that any further notification expenses will be covered by its cyber insurance policy.

"It is possible that future risks and uncertainties resulting from the January 2025 Cyber Event, including those related to impacted data, litigation, reputational harm, and regulatory actions, could adversely affect the Company’s financial condition or results of operations," Conduent stated.

According to IBM's 2025 "Cost of a Data Breach" report, the global average cost of a data breach across all industries is $4.44 million per breach. However, costs remain high in the U.S., with average breach costs rising to $10.22 million in 2025. Higher regulatory fines and steep containment costs can contribute greatly to total breach recovery costs.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.