Conduent

Summary

A ransomware attack on government technology and business services contractor Conduent resulted in operational outages and a massive data breach affecting at least 25 million people across multiple U.S. states, with Oregon and Texas accounting for the majority of impacted individuals. The Safeway ransomware gang claimed responsibility for the incident, stating it stole more than 8 terabytes of data. Stolen information included names, dates of birth, addresses, Social Security numbers, health insurance information, and medical data belonging to individuals served through government healthcare programs and corporate benefit services. Conduent disclosed the cybersecurity incident after restoring its systems and later filed disclosures with the SEC acknowledging that the stolen datasets contained a significant number of individuals' personal information tied to its clients' end users. Notification letters to affected individuals were sent on behalf of Conduent's clients, with the company working to complete the notification process.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In January 2025, Conduent, a major American business services and government technology contractor, experienced a cybersecurity incident that caused widespread service outages across the United States. The company, which employs over 31,000 people and serves half of the Fortune 100 as well as more than 600 government and transportation agencies, initially described the event as a "service interruption." Affected clients included the Wisconsin Department of Children and Families, Oklahoma Human Services, and other state organizations, many of which rely on Conduent for processing payments via electronic transfer or EBT cards. The disruption impaired the Wisconsin Support Collections Trust Fund's ability to process payments, prompting Conduent's technology team to restore systems within a few days. After being pressed by media for confirmation, Conduent acknowledged that the operational disruption had been caused by a "cyber security incident," which it stated was contained and fully resolved.

By April 2025, Conduent publicly disclosed the cyberattack in a Form 8-K filing with the U.S. Securities and Exchange Commission, months after the initial breach had disrupted its operations and the services of its government clients. The incident was later attributed to the Safeway ransomware gang, which claimed responsibility for the attack and stated that it had exfiltrated more than 8 terabytes of data from Conduent's systems. The attackers' intrusion knocked out Conduent's operations for several days, resulting in outages that affected government services nationwide. In a subsequent SEC filing, the company confirmed that the stolen data sets "contained a significant number of individuals' personal information associated with our clients' end-users," indicating that the breach extended to data belonging to people served by Conduent's corporate and government customers.

Beginning in October 2025, Conduent issued its first data breach notifications, alerting affected individuals that their personal information had been compromised. The stolen data included names, dates of birth, addresses, Social Security numbers, health insurance information, and medical data. Initial disclosures suggested approximately 4 million people were affected in Texas alone, but subsequent updates expanded the scope significantly. By early 2026, state-level data breach notification pages and filings with state attorneys general revealed that more than 15.4 million people in Texas and 10.5 million people in Oregon had been impacted, accounting for the majority of the affected individuals. Additional notifications covered residents of Delaware, Massachusetts, New Hampshire, Washington, and other states, bringing the known total of affected individuals to at least 25 million people across the United States.

The scale of the breach stemmed from Conduent's role as a major processor of sensitive information for state agencies and large corporations. The company provides printing, mailroom services, and document and payment processing for state government benefit operations, including food assistance and unemployment benefits, and supports workplace benefits for large corporations. Conduent states that its technology and operational support services reach more than 100 million people in the United States, though it has not confirmed that the breach affects that many individuals. The breach has been characterized as one of the largest in U.S. history, though it is believed to trail behind the February 2024 ransomware attack on Change Healthcare, which affected more than 190 million people through the use of a stolen credential that lacked multi-factor authentication.

In response to the incident, Conduent stated that it had been working with law enforcement and conducting a detailed analysis of the affected files to identify the personal information taken in the breach. The company set up a dedicated call center to address consumer inquiries and coordinated with its clients to send out notification letters to affected individuals. In statements to the press, a Conduent spokesperson said the company expected to send out all consumer notifications by April 15, 2026, and emphasized that both Conduent and its third-party experts had found no evidence of the stolen personal information being released on the dark web. The company also confirmed that it was continuing its notification process through the early months of 2026, though it provided no specific timeline for completion beyond that window. The combination of Social Security numbers, medical data, and health insurance information exposed in the breach created significant risks for identity theft, medical fraud, and targeted scams for the millions of individuals whose data was compromised.

Sources

Sources available to members: 4 sources.