Loading story…
Volvo Group North America disclosed an indirect data breach after attackers compromised systems at its vendor Conduent, a business process outsourcing provider that handles workforce benefits and other back-office services. Notifications and regulatory filings indicate 16,991 affected individuals tied to Volvo in the US, with intruders having access to Conduent environments from October 21, 2024 to January 13, 2025; Volvo learned in late January and later confirmed its exposure as Conduent and customers worked to determine downstream impact.
Exposed data included names, with reporting also describing theft of highly sensitive identifiers such as SSNs, dates of birth, and health/insurance-related information (e.g., policy details and medical data), though the exact data elements may vary by individual. Conduent reported discovering the intrusion in January 2025, taking containment actions and engaging forensic investigators; impacted parties are being offered identity monitoring/credit monitoring services and advised to consider fraud alerts or credit freezes, underscoring the extended notification timelines and broad blast radius typical of large third-party service provider breaches.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
By February 2026, reporting on the Conduent case publicly linked the intrusion to the SafePay ransomware group, though Conduent had not confirmed the attribution in the cited coverage. The reporting also highlighted the long delay between Conduent's 2025 detection and downstream customer notification.
Volvo notified regulators that the third-party Conduent breach exposed sensitive personal and health-related information for nearly 17,000 affected individuals. Conduent began sending notifications on behalf of customers and offered identity monitoring and related protection services.
Volvo Group North America said it learned in late January 2026 that data tied to current or former health plans had been accessed through Conduent's systems. The company later reported that nearly 17,000 of its employees and/or customers were affected in the United States.
Subsequent regulatory disclosures indicated the scope of the Conduent breach expanded significantly, with reported totals rising from about 10 million people to roughly 25 million. State filings cited impacts including 10.5 million people in Oregon and 15.5 million in Texas, alongside additional affected organizations such as insurers and Wisconsin state agencies.
Conduent said it learned of the incident on January 13, 2025, and that the unauthorized access window ran from October 21, 2024, to January 13, 2025. The company locked down affected systems and engaged forensic investigators after discovery.
Attackers gained access to Conduent systems on October 21, 2024, starting an intrusion that would later be tied to theft of sensitive personal and health-related data from Conduent customers' records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Volvo North America reported a data breach affecting its employees after a ransomware attack targeted its third-party human resources software provider, Miljödata. The incident began on August 20, 2025, when Miljödata was compromised by the ransomware group DataCarry, which later claimed responsibility and published stolen data on its Tor leak site. Miljödata discovered the attack on August 23, 2025, and after an internal investigation, determined on September 2, 2025, that Volvo Group North America employee data had been impacted. The breach exposed sensitive personal information, including names and Social Security numbers, of current and former Volvo employees. According to notifications sent to affected individuals, Volvo’s own systems were not directly compromised; the breach was limited to data managed by Miljödata. The affected HR systems are used for managing medical certificates, rehabilitation, and work-related injury reporting, and the attack impacted at least 25 organizations, including major companies and hundreds of Swedish municipalities. The total number of affected Volvo employees has not been officially disclosed, but reports suggest it could be several thousand. The data breach notification service Have I Been Pwned indicated that the overall leak from Miljödata involved data from 870,000 accounts, though not all were necessarily Volvo employees. Impacted individuals are at risk of identity theft or fraud due to the exposure of their Social Security numbers. In response, Miljödata engaged cybersecurity experts, enhanced its hosted environment’s security, and is working to prevent future incidents. Volvo notified the Massachusetts Attorney General about the breach, fulfilling regulatory requirements. The breach highlights the risks associated with third-party vendors and the potential for widespread impact when such providers are compromised. Other organizations affected by the Miljödata attack include Scandinavian airline SAS and mining company Boliden. The incident underscores the importance of robust vendor risk management and timely breach notification procedures. DataCarry’s publication of the stolen data increases the urgency for affected individuals to monitor for misuse of their personal information. The breach has drawn attention to the need for improved security controls in HR software platforms used by large enterprises. Volvo’s transparency in communicating the breach to employees and authorities is a critical component of its incident response. The event serves as a reminder of the cascading effects a single ransomware attack on a service provider can have across multiple industries and organizations.
Jun 29, 2026
Conduent, a major government payments and services contractor, confirmed that a cyberattack disrupted operations across multiple U.S. states after the company detected unauthorized activity in January 2025. Reporting at the time said the outage affected government technology and payment services, while later disclosures stated an unauthorized third party had access to part of Conduent’s network from **October 21, 2024, through January 13, 2025**. A subsequent SEC filing indicated the company was continuing to assess the incident and its downstream impact on customers and individuals. By early 2026, the scope had widened dramatically: media reports and a Missouri Department of Commerce and Insurance bulletin said files exposed in the breach contained names, addresses, Social Security numbers, and medical records, with **25 million or more Americans** potentially affected. Missouri regulators said Conduent had not provided enough information to determine the impact on insurance consumers and asked insurers and other regulated entities that used Conduent during the exposure window to report their involvement, raising the prospect that the incident could rank among the largest U.S. data breaches on record.
Jun 29, 2026
Conduent Business Solutions LLC has disclosed a major data breach affecting over 10.5 million individuals, including patients of Blue Cross Blue Shield of Montana and Humana. The breach, discovered in January, involved unauthorized access by a threat actor to a limited portion of Conduent's environment, resulting in the theft of sensitive data. The incident is considered one of the largest healthcare data breaches of 2025, with notifications sent to state regulators and impacted individuals, though the full scope across other sectors remains unclear. Conduent reported the incident to the U.S. Securities and Exchange Commission in April, following operational disruptions and public notices from affected state agencies such as Oklahoma. The company has not specified whether clients outside the healthcare sector were impacted. Upon discovery, Conduent activated its cybersecurity response plan and engaged external experts to assist with the investigation and remediation efforts. The breach has not yet appeared on the U.S. Department of Health and Human Services' HIPAA breach reporting website, likely due to a federal shutdown at the time of reporting.
Jun 29, 2026