Loading story…
Conduent Business Solutions LLC has disclosed a major data breach affecting over 10.5 million individuals, including patients of Blue Cross Blue Shield of Montana and Humana. The breach, discovered in January, involved unauthorized access by a threat actor to a limited portion of Conduent's environment, resulting in the theft of sensitive data. The incident is considered one of the largest healthcare data breaches of 2025, with notifications sent to state regulators and impacted individuals, though the full scope across other sectors remains unclear.
Conduent reported the incident to the U.S. Securities and Exchange Commission in April, following operational disruptions and public notices from affected state agencies such as Oklahoma. The company has not specified whether clients outside the healthcare sector were impacted. Upon discovery, Conduent activated its cybersecurity response plan and engaged external experts to assist with the investigation and remediation efforts. The breach has not yet appeared on the U.S. Department of Health and Human Services' HIPAA breach reporting website, likely due to a federal shutdown at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
By early November 2025, reporting indicated that legal complaints and regulatory investigations were piling up in response to the Conduent breach. The incident's fallout was described as ongoing and significant given its scale and healthcare impact.
By late October 2025, Conduent's SEC filing and state breach notifications showed that data theft affected more than 10.5 million people, including clients such as Humana and Blue Cross Blue Shield of Montana. The exposed information included Social Security numbers, medical information, and health insurance data, making it one of the largest healthcare-related breaches of 2025.
Montana regulators disclosed they were investigating a Conduent-related breach affecting about 462,000 Blue Cross Blue Shield of Montana members. The inquiry also raised concerns about an approximately 10-month delay in notifying affected individuals.
After assessing the stolen data, Conduent started notifying affected clients and regulators in multiple states as required by law. State filings later showed exposure of sensitive personal and health-related data across several jurisdictions.
In February 2025, the SafePay ransomware gang claimed the attack, alleging it stole 8.5 TB of data and threatening to publish or sell the information. Conduent said it had not seen evidence that the exfiltrated data was posted publicly or released on the dark web.
Following discovery of the breach, Conduent brought in external cybersecurity and data-mining experts to investigate the stolen files and involved federal law enforcement. The company later said it spent about $2 million on response efforts and expected some cyber insurance recovery.
On January 13, 2025, Conduent detected the incident, disclosed an operational disruption, and determined that an unnamed threat actor had accessed a limited portion of its environment and exfiltrated files tied to a limited number of clients. The company said some systems were restored within hours and others within days.
Attackers gained unauthorized access to Conduent's environment on or about October 21, 2024, beginning a months-long compromise that later led to data theft. Reports indicate the intrusion persisted until it was discovered in January 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Conduent, a major government payments and services contractor, confirmed that a cyberattack disrupted operations across multiple U.S. states after the company detected unauthorized activity in January 2025. Reporting at the time said the outage affected government technology and payment services, while later disclosures stated an unauthorized third party had access to part of Conduent’s network from **October 21, 2024, through January 13, 2025**. A subsequent SEC filing indicated the company was continuing to assess the incident and its downstream impact on customers and individuals. By early 2026, the scope had widened dramatically: media reports and a Missouri Department of Commerce and Insurance bulletin said files exposed in the breach contained names, addresses, Social Security numbers, and medical records, with **25 million or more Americans** potentially affected. Missouri regulators said Conduent had not provided enough information to determine the impact on insurance consumers and asked insurers and other regulated entities that used Conduent during the exposure window to report their involvement, raising the prospect that the incident could rank among the largest U.S. data breaches on record.
Jun 29, 2026
Montana state regulators are investigating a data breach that impacted 462,000 members of Blue Cross Blue Shield of Montana (BCBSMT) after sensitive data was stolen from the insurer's third-party vendor, Conduent. The breach, detected in January 2025, led to questions about delayed notification, as nearly ten months passed before affected individuals were informed. Conduent, which provides mailroom and payment processing services, took almost four months to notify federal regulators, and BCBSMT has stated that while its own systems were not compromised, its members were affected due to the vendor relationship. Authorities are scrutinizing both the timeline of notifications and the responsibilities of BCBSMT and Conduent in protecting member data. Impacted individuals will receive notification letters from Conduent, and the incident highlights ongoing risks associated with third-party service providers in the healthcare sector. The investigation is ongoing as regulators seek to determine whether notification requirements were met and to assess the broader implications for data security and regulatory compliance in healthcare partnerships.
Jun 29, 2026
Continuum Health Alliance, a health management provider based in New Jersey, agreed to settle a consolidated class action lawsuit following a data breach in October 2023 that compromised the personal information of over 377,000 patients from its client, Consensus Medical Group. The breach involved unauthorized access to sensitive data, including names and Social Security numbers, and led to multiple legal claims consolidated in New Jersey court. The settlement was reached after mediation, with all parties agreeing it was preferable to continued litigation, though the defendants denied liability. Separately, Denton County MHMR Center in Texas reported a significant data breach affecting nearly 109,000 patients, with unauthorized access occurring in December 2024. The compromised data included a wide range of protected health information, and affected individuals were notified and offered credit monitoring services. Additionally, Conduent, a major medical services provider, disclosed that a 2024 hacking incident impacted nearly 14.8 million Texans, a substantial increase from previous estimates, highlighting the ongoing challenges in accurately assessing the scope of large-scale healthcare data breaches and the risks posed by third-party vendors.
Jun 29, 2026