Conduent Breach: 25M to 62M, Social Security Numbers Exposed

Conduent Breach Grows From 25 Million to 62.2 Million: Social Security Numbers, Health Data, and a Pending Settlement

The Conduent data breach affected 62,224,658 people, according to the updated total Conduent gave the HHS Office for Civil Rights, as reported by The HIPAA Journal in June 2026. That is more than double the 25 million figure that circulated in February, when CNET reported the breach "could affect 25M people" and Malwarebytes counted more than 25 million from state filings. The stolen files held names, addresses, dates of birth, Social Security numbers, medical information, and health insurance details, taken from the New Jersey back-office vendor between October 21, 2024, and January 13, 2025.

The litigation is now close to a resolution. In a September 10, 2026 SEC filing, Conduent said it reached an agreement in principle in August to settle the consolidated class action in federal court in New Jersey. The terms have not been disclosed, and the court has not approved the deal. The next day, Judge Michael E. Farbiarz ordered plaintiffs to file a motion for preliminary approval by October 13.

What Was Stolen

Conduent provides printing, mailroom, payment processing, and other back-office services to health plans, state benefit programs, and employers. Malwarebytes noted that the company's platforms handle Medicaid, SNAP, and other government payment programs in more than 30 states, which is why many people who got a letter had never heard of Conduent.

The compromised data varies by person and by client. According to The HIPAA Journal, it includes names, addresses, dates of birth, Social Security numbers, medical information such as treatment details, health insurance information, and claims information. The SafePay ransomware group claimed the attack in February 2025 and said it stole 8.5 terabytes of data. In its latest quarterly report, Conduent said that to its knowledge the exfiltrated data has not been released on the dark web or elsewhere.

Known affected clients include Blue Cross and Blue Shield plans in Texas, Montana, and Illinois, along with Premera Blue Cross, Humana, and Volvo Group North America, where about 17,000 employees were affected. The full client list has not been published.

"SSNs plus medical and insurance data enable long-tail identity theft, medical fraud, and highly targeted phishing that can haunt victims for years," wrote Pieter Arntz, malware intelligence researcher at Malwarebytes.

The Scale in Context

At 62.2 million people, Conduent is the third-largest healthcare data breach ever reported to OCR, behind the Change Healthcare breach of 2024 at 192.7 million and the 2015 Anthem breach at 78.8 million, according to The HIPAA Journal's breach statistics. Adding Conduent pushed the number of people affected by large healthcare breaches reported since 2009 past 1 billion.

The real total may still be higher. The HIPAA Journal pointed out that each covered entity client is responsible for its own notices, and it is unclear whether every client let Conduent send them.

Healthcare set a new record in 2025 with 772 large breaches reported, about 4% more than in 2024, and Conduent was the largest of them.

Legal Fallout

Class Action Settlement

Lawsuits filed after the October 2025 notices were consolidated as In re: Conduent Business Services Data Breach Litigation (Case No. 2:25-cv-16953) in the U.S. District Court for the District of New Jersey before Judge Michael E. Farbiarz. Plaintiffs filed a consolidated complaint on March 18, 2026, and an amended complaint on June 12, 2026, according to Conduent's 10-Q. The amended complaint also names health insurers that used Conduent, including Elevance Health, Health Care Service Corporation, Humana, and The Cigna Group. The suits allege negligence, negligence per se, unjust enrichment, and breach of third-party beneficiary contract.

The court stayed the case through September 7, 2026, so the parties could mediate before Judge Diane M. Welsh on August 13. Conduent's 8-K says the company reached an agreement in principle that month, still denies the allegations, and does not expect the settlement to have a material financial impact because it carries cyber insurance. The settlement amount, class definition, and any claims deadline have not been made public.

State Regulators

Texas Attorney General Ken Paxton opened an investigation into Conduent and Blue Cross Blue Shield of Texas in February 2026. "The Conduent data breach was likely the largest breach in U.S. history," Paxton said.

Texas is not the only state looking into the breach. In April 2026, a Montana court let the state insurance commissioner's investigation of Blue Cross Blue Shield of Montana, which reported 462,000 affected Montanans, move forward. In May, Missouri's Department of Commerce and Insurance said Conduent had not given it enough information to assess the breach, and Conduent said it was cooperating as far as its legal and contractual obligations allow. The company's 10-Q says it has been responding to several subpoenas, information requests, and investigations from government agencies.

The Notification Gap

HIPAA's breach notification rule requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Conduent detected the intrusion on January 13, 2025, and Blue Cross Blue Shield of Montana heard from Conduent within a few days. Letters to individuals did not start until October 2025. Conduent's 10-Q attributes the gap to a "time intensive data analysis" of complex files, while plaintiffs argue the delay left victims unprotected.

Identity Theft Resource Center president James E. Lee told AZFamily that the damage could already have been done given the timeline. Conduent offered 12 months of free credit monitoring, but by May 2026 the enrollment deadline had passed, and Missouri regulators advised consumers to check their credit reports and consider a fraud alert or credit freeze instead.

What This Means for Law Firms Handling Medical Records

The Conduent breach is a case study in third-party vendor risk. Any organization handling medical records is only as secure as the vendors it sends them to.

Supply Chain Exposure

The breach did not stay inside Conduent. It reached state benefit programs, health insurers, and corporate benefits programs that relied on Conduent to process their data, and several of those insurers are now co-defendants. For law firms, the lesson is direct: any vendor involved in medical records retrieval, claims processing, or document management is a potential point of compromise.

Security analysts at Blacksmith Infosec noted that Conduent's profile, with standard security attestations and long government contracts, would have passed most vendor reviews. SOC 2 reports describe controls over a set period, while the attackers had roughly three months of continuous access, "a window no annual audit can capture."

What Firms Should Verify

For any vendor handling medical records or client data, firms should verify SOC 2 Type II certification with a current audit report, encryption at rest and in transit, role-based access controls with audit logging, an incident response plan with defined notification timelines, and whether data is stored in shared or isolated environments. Conduent shows that a completed security questionnaire is not enough. How the vendor actually operates matters more.

The Bottom Line

The Conduent breach shows that medical record data is only as secure as the infrastructure handling it. For law firms managing medical evidence across mass tort portfolios, personal injury cases, and litigation support, vendor security is a direct liability issue, not a compliance checkbox.

A 62.2 million person breach, a nine-month wait for letters, and a class settlement now headed for court review all trace back to one vendor. For firms re-evaluating their medical record retrieval service, the question is whether their vendors can show, not just claim, that sensitive data is encrypted, isolated, and monitored in real time.

Sources: The HIPAA Journal, Conduent breach coverage, The HIPAA Journal, healthcare data breach statistics, The HIPAA Journal, Montana investigation, Conduent Form 8-K, September 10, 2026, Conduent Form 10-Q, Q2 2026, CourtListener docket, No. 2:25-cv-16953, CNET, Malwarebytes, TechTarget, AZFamily, Blacksmith Infosec, KFF Health News.