Volvo Group

Summary

A business services provider that handles printing, mailroom, document processing, payment integrity, and back-office support functions for major corporations suffered a network intrusion that went undetected for an extended period. The attackers accessed personal information including names, addresses, Social Security numbers, dates of birth, health insurance details, and medical information. The Safepay ransomware group later claimed responsibility for the attack. Among the affected clients, the U.S. arm of a major truck, bus, and industrial equipment manufacturer reported that nearly 17,000 employees had their data exposed, with the company learning of the incident only after the breach had already been disclosed publicly. This marked the second third-party incident to impact the manufacturer within roughly a year, following a separate ransomware-related breach at a Swedish IT vendor that had compromised employee data.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Volvo Group North America was impacted by a data breach that originated not from its own systems but from a third-party business services provider, Conduent. Conduent detected an intrusion on its network on January 13, 2025, and a subsequent investigation revealed that the attackers had maintained access to its network since October 21, 2024. This extended dwell time allowed the threat actors to obtain a broad range of personal information belonging to individuals connected to Conduent's client base. According to breach notification letters, the compromised data included names, addresses, Social Security numbers, dates of birth, health insurance data, and medical information. The Safepay ransomware group publicly claimed responsibility for the attack on Conduent in February 2025. Conduent provides a variety of back-office support functions to its clients, including printing and mailroom services, document processing, and payment integrity services, which explains how data belonging to Volvo Group employees came to reside on Conduent's systems.

The scope of the breach as it relates to Volvo Group became clearer through notifications submitted to state attorney general offices. Conduent filed an initial data breach notification with the Maine Attorney General's office on behalf of Volvo Group, indicating that nearly 17,000 Volvo Group employees were affected by the incident. Volvo Group itself appears to have learned about the incident only in January 2026, more than a year after Conduent first detected the intrusion. The broader impact of the Conduent breach extends well beyond Volvo Group, affecting roughly 10 million individuals based on notifications submitted in October 2025. Subsequent updates shared by Conduent with various state attorney generals indicate that the total number of impacted individuals has more than doubled, with figures climbing from approximately 4 million to 15 million in Texas alone, and over 10 million people affected in Oregon. Despite these escalating numbers in other jurisdictions, the company had not yet provided an updated total to the Maine Attorney General's office at the time of reporting, having previously reported only that 374 Maine residents were affected.

This incident represents the second third-party data breach to affect Volvo Group in recent months. In September 2025, the truck maker notified its employees of a separate breach involving Miljödata, a Swedish IT company that had been targeted in a ransomware attack. The recurrence of such incidents highlights the exposure that large organizations face through their reliance on external service providers for handling sensitive employee data. Notifications sent to impacted individuals on behalf of Volvo Group confirmed the nature of the data exposed and the relationship between Conduent and Volvo Group, though specific containment actions taken by Conduent or Volvo Group have not been publicly detailed in the available reporting.

Sources

Sources available to members: 1 source.