Conduent Breach Becomes One of 2024’s Largest, Affecting 15.5 Million

Conduent Business Services, an American IT and business services provider, said that the data security incident it suffered in 2024 compromised the sensitive personal data of nearly 15.5 million people.

Conduent, which provides mailroom, document processing, printing, and other administrative services for HIPAA-covered entities and public agencies, suffered a significant data security incident in late 2024 that was publicly disclosed in early 2025. The breach involved unauthorised access to Conduent’s internal network, with the threat actor remaining undetected for nearly three months—from October 21, 2024, to January 13, 2025.

The incident resulted in the exfiltration of approximately 8.5 terabytes of confidential data including names, Social Security numbers, dates of birth, treatment details, claim numbers, and health insurance information. Notably impacted clients included major healthcare insurers like Premera Blue Cross, Blue Cross Blue Shield of Montana, Blue Cross and Blue Shield of Texas, and Humana.

Conduent notified affected individuals and state attorneys general about the incident. In a filing with the Oregon Attorney General, the company said approximately 10.5 million individuals were impacted. However, a later breach notification submitted to the Texas Attorney General indicated that the incident compromised the personal and protected health information of nearly 14.8 million individuals.

A recent filing with a Texas state regulator confirms that the scope of the 2024 data breach has expanded significantly, with the new disclosure indicating that up to 15,494,592 individuals in Texas alone were affected.

The SafePay ransomware group claimed responsibility for the cyber attack and added Conduent to its dark web data leak site in early 2025. The group said it had stolen 8.5 TB of data and threatened to publish the information unless a ransom was paid. Conduent was later removed from the site, though no confirmation has been provided on whether the data was deleted or if any ransom demand was met.