Skip to content
Breach Index · running record

Conduent data breach: how a January 2025 ransomware attack grew to 62 million people

Conduent runs back-office services for US state Medicaid, benefits and toll programmes, so most people affected never knew it held their data. Its January 2025 ransomware attack became one of the largest US healthcare breaches on record as state-by-state notices rolled in. This page is the running record, with each count tied to the filing it came from.

Short answer

Was Conduent hacked?

Yes. Conduent’s annual report says that on 13 January 2025 it suffered an operational disruption and found that a threat actor had accessed a limited portion of its environment. Notices later put the intruder inside from 21 October 2024 until 13 January 2025, and the stolen files included names, Social Security numbers, medical information and health-insurance details of people served by Conduent’s government and healthcare clients.

The count kept growing as clients identified whose data was in the files: 10.5 million in an Oregon filing, about 14.8–15.4 million in Texas alone, and 62,224,658 on the HHS Office for Civil Rights breach portal by June 2026, which reporting ranks third-largest in that portal’s history. The SafePay ransomware group claimed the attack; Conduent has not confirmed the group or its 8.5TB claim.

Timeline at a glance

  1. 21 Oct 2024Unauthorised access begins, per breach notices. (teiss)Confirmed
  2. 13 Jan 2025Operational disruption; Conduent finds a threat actor in its environment. (Conduent 10-K)Confirmed
  3. Late 2025Oregon filing: ~10.5M people. SafePay claims 8.5TB (unverified). (TechCrunch)Confirmed
  4. Jan–Feb 2026Texas filings: 14,791,500 then ~15.4M Texans. (TechCrunch)Confirmed
  5. Jun 2026HHS OCR portal updated to 62,224,658 people. (Paubox (HHS portal))Confirmed

Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Conduent incident timeline, in detail

Confirmed = acknowledged by Conduent, a regulator filing or a court. Reported = credible reporting Conduent has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Oct 2024 – Jan 2025ConfirmedRansomware / third-party processor

Ransomware attack on a government-services contractor; client end-user data stolen

What happened. Conduent’s FY2025 10-K says it experienced an operational disruption on 13 January 2025 and learned that a threat actor had gained unauthorised access to a limited portion of its environment. Breach notices put the start of access at 21 October 2024. Conduent later told the SEC the stolen datasets “contained a significant number of individuals’ personal information associated with our clients’ end-users.” The attack knocked out Conduent’s operations for several days.

Impact. Names, Social Security numbers, medical information and health-insurance details. The HHS OCR portal lists 62,224,658 affected individuals. Paubox, citing Conduent’s disclosures, reports $25 million in direct response costs in Q1 2025 and a further $16 million expected through Q1 2026. Conduent offered 12 months of credit monitoring and said it had no evidence the data had been misused.

Sources: Conduent FY2025 10-K · TechCrunch, 5 Feb 2026 · Paubox, 17 Jun 2026

2025Unverified claimThreat-actor claim

SafePay ransomware group claims the attack and 8.5TB of data

What happened. The SafePay group listed Conduent on its leak site and claimed to have stolen about 8.5TB. Conduent has not confirmed the group’s identity or the volume.

Impact. The volume and any payment remain unconfirmed.

Sources: teiss, 8 Jan 2026

Where the reports disagree

  • The headcount: an early HHS entry showed 42,616 people (a placeholder), Oregon listed about 10.5 million, Texas filings rose from 14,791,500 (January 2026) to about 15.4 million (February 2026), and the HHS portal reached 62,224,658 by June 2026. Conduent itself declined to give a national total to TechCrunch. The numbers differ because each client had to work out whose data was in the stolen files.

The pattern across the record

The processor, not the programme, was breached

Medicaid agencies, insurers and toll authorities outsourced processing to Conduent. Their beneficiaries were exposed through a vendor most had never heard of, and each client had to run its own notification.

Breach counts grow for months

A processor holding many clients’ data cannot give one number on day one. Plan for a count that rises in public, and for regulators who ask questions you cannot yet answer.

What it means for Conduent clients and affected people — and what to do

If you received a Conduent letter, your data came from a state agency, health plan or other client that uses Conduent. If you run a programme that outsources to a processor like it, this is the scenario to plan for.

  1. 1.Freeze your credit and enrol in the monitoring offered

    Social Security numbers were taken. A freeze at all three US bureaus is free and stops new-account fraud.

  2. 2.Watch health-insurance statements

    Medical identity theft shows up as care or claims you did not receive. Check explanation-of-benefits notices.

  3. 3.For agencies and insurers: know what your processor holds

    Keep a current map of which datasets each processor has, and contractual rights to a file-level list of what was taken.

    Third-party breach intake
  4. 4.Pre-agree notification responsibilities

    Decide in the contract who notifies whom, on whose letterhead, and who pays.

    Contract clause library

CISO takeaways

Rehearse ransomware at a processor

Work through the decisions when your vendor is down and your data is on a leak site.

Ransomware tool
Third-party breach response

From first vendor notice to individual letters.

Third-party breach checklist
Map the clocks

HIPAA, state AG and contractual deadlines start at different moments.

Notification clocks
Estimate the cost

Put a range on notification, monitoring and response for a breach of this shape.

Breach cost calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed October 30, 2026.

  1. 1.Conduent Inc. Form 10-K for fiscal 2025 — SEC EDGAR, 2026
  2. 2.Data breach at govtech giant Conduent balloons — TechCrunch, 5 Feb 2026
  3. 3.Conduent data breach impact expands as Texas filing shows nearly 14.8 million affected — teiss, 8 Jan 2026
  4. 4.Conduent breach hits 62M, ranking third-largest in US healthcare history — Paubox, 17 Jun 2026
  5. 5.Breach portal: cases currently under investigation — HHS Office for Civil Rights, accessed Oct 2026

Frequently asked questions

Was Conduent hacked?

Yes. Conduent says it found a threat actor in its environment on 13 January 2025 after an operational disruption. Breach notices put the intrusion from 21 October 2024 to 13 January 2025.

How many people were affected by the Conduent data breach?

The HHS Office for Civil Rights breach portal lists 62,224,658 people as of June 2026. Earlier state filings showed about 10.5 million (Oregon) and about 14.8–15.4 million in Texas alone. Conduent has not published its own national total.

What data was stolen from Conduent?

Names, Social Security numbers, medical information and health-insurance details of people served by Conduent’s government and healthcare clients. Exact fields vary by client.

Why did I get a Conduent letter if I never used Conduent?

Conduent processes data for state Medicaid and benefits programmes, health plans and other clients. Your data reached Conduent through one of them.

Who was behind the Conduent attack?

The SafePay ransomware group claimed it and said it took 8.5TB. Conduent has not confirmed the attacker or the volume.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Booz Allen Hamilton data breachGovernment contractor

Snowden, Harold Martin, and a 2017 unsecured S3 bucket.

Deloitte data breachBig Four

The 2017 no-MFA email breach and the $12M RIBridges incident.

PwC data breachBig Four

The Oct 2026 vendor incident, MOVEit and LuxLeaks.

EY (Ernst & Young) data breachBig Four

MOVEit, a 2025 Azure backup exposure, a third-party signature.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Conduent. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout