Loading story…
Conduent and plaintiffs representing approximately 62.2 million people reached a preliminary $80 million settlement over a data breach that began in October 2024 and continued into January 2025. Plaintiffs alleged that the SafePay ransomware group exfiltrated approximately 8.5 terabytes of data, including Social Security numbers, health insurance details and medical information. Conduent denies wrongdoing or liability, and the agreement remains subject to court approval.
The proposed settlement provides financial compensation, credit or medical data monitoring, identity theft insurance and commitments to strengthen Conduent’s cybersecurity. It distinguishes between information held in complex backup files and information readily accessible to unauthorized third parties—a distinction relevant to assessing exposure and potential harm. The case highlights the financial and privacy consequences of ransomware-related data theft involving sensitive identity and healthcare records.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Conduent and plaintiffs representing approximately 62.2 million people filed a proposed $80 million settlement in New Jersey federal court, providing compensation, monitoring services and cybersecurity commitments. Conduent denied wrongdoing or liability, and the agreement remained subject to court approval.
Conduent first publicly disclosed the breach in an April 2025 filing with the U.S. Securities and Exchange Commission.
The cyberattack continued until approximately January 13, 2025, according to court documents describing unauthorized access and the exfiltration of files containing clients’ entrusted private information.
A cyberattack on Conduent’s network began on or about October 21, 2024. Plaintiffs alleged that the SafePay ransomware group exfiltrated approximately 8.5 terabytes of data, including Social Security numbers, health insurance details and medical information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Conduent, a major government payments and services contractor, confirmed that a cyberattack disrupted operations across multiple U.S. states after the company detected unauthorized activity in January 2025. Reporting at the time said the outage affected government technology and payment services, while later disclosures stated an unauthorized third party had access to part of Conduent’s network from **October 21, 2024, through January 13, 2025**. A subsequent SEC filing indicated the company was continuing to assess the incident and its downstream impact on customers and individuals. By early 2026, the scope had widened dramatically: media reports and a Missouri Department of Commerce and Insurance bulletin said files exposed in the breach contained names, addresses, Social Security numbers, and medical records, with **25 million or more Americans** potentially affected. Missouri regulators said Conduent had not provided enough information to determine the impact on insurance consumers and asked insurers and other regulated entities that used Conduent during the exposure window to report their involvement, raising the prospect that the incident could rank among the largest U.S. data breaches on record.
Jun 29, 2026
Conduent Business Solutions LLC has disclosed a major data breach affecting over 10.5 million individuals, including patients of Blue Cross Blue Shield of Montana and Humana. The breach, discovered in January, involved unauthorized access by a threat actor to a limited portion of Conduent's environment, resulting in the theft of sensitive data. The incident is considered one of the largest healthcare data breaches of 2025, with notifications sent to state regulators and impacted individuals, though the full scope across other sectors remains unclear. Conduent reported the incident to the U.S. Securities and Exchange Commission in April, following operational disruptions and public notices from affected state agencies such as Oklahoma. The company has not specified whether clients outside the healthcare sector were impacted. Upon discovery, Conduent activated its cybersecurity response plan and engaged external experts to assist with the investigation and remediation efforts. The breach has not yet appeared on the U.S. Department of Health and Human Services' HIPAA breach reporting website, likely due to a federal shutdown at the time of reporting.
Jun 29, 2026
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026