Conduent Breach Reaches 25 Million Americans, Making It the Largest in U.S. History
A ransomware attack on government services giant Conduent exposed SSNs, medical records, and health insurance data for at least 25 million Americans across multiple states.
Overview
A ransomware attack against Conduent Business Services — a company that quietly processes Medicaid claims, child support payments, food assistance, and corporate HR data for more than 100 million Americans — has grown into what the Texas Attorney General is calling “likely the largest data breach in U.S. history.” As of late February 2026, more than 25 million people have received or are still awaiting notification letters informing them that their Social Security numbers, medical records, and other sensitive personal information were stolen.
Most affected individuals have never heard of Conduent. The company operates as a back-office infrastructure provider — a third-party processor whose systems sit invisibly between citizens and the state agencies or employers that serve them.
What Happened
The breach began on October 21, 2024, and ran undetected for nearly three months until discovery on January 13, 2025, according to reporting by TechCrunch. The SafePay ransomware group claimed responsibility, stating it had exfiltrated approximately 8 terabytes of data from Conduent’s environment. The group threatened to publish the stolen files unless a ransom was paid; Conduent has not disclosed whether it complied. As of early 2026, Conduent is no longer listed on SafePay’s public leak site.
The attack disrupted government benefit delivery in at least two states. Wisconsin and Oklahoma experienced outages of Electronic Benefit Transfer (EBT) services — the system used to distribute food assistance — in January 2025, events that were later attributed to the Conduent breach.
Conduent disclosed the incident to the SEC via an 8-K filing in April 2025, but notification letters to affected individuals did not begin until October 2025 — approximately nine months after discovery. The company says it expects to complete all consumer notifications by April 15, 2026.
Scale and Geography
As Malwarebytes reports, the breach’s scope has expanded dramatically as states file their own disclosure notices. Initial filings suggested roughly 10.5 million affected individuals, a figure concentrated in Oregon. Subsequent disclosures have pushed the confirmed total past 25 million:
- Texas: More than 15.4 million residents affected, up from an initial estimate of approximately 4 million
- Oregon: Approximately 10.5 million residents, among the first states to file public notice
- Additional states: Georgia, South Carolina, New Jersey, New Hampshire, Maine, Massachusetts, New Mexico, and others have each confirmed affected residents
Texas Attorney General Ken Paxton issued civil investigative demands to both Conduent and Blue Cross Blue Shield of Texas over their compliance with state law, and characterized the incident as potentially the largest breach in U.S. history.
What Data Was Stolen
The categories of information exposed varied depending on which Conduent client relationship each individual had, but according to Gizmodo and official notification letters, the compromised data includes:
- Full legal names
- Dates of birth
- Home addresses
- Social Security numbers
- Health insurance policy and member ID numbers
- Medical information and treatment records
Notification letters sent to victims notably do not identify which Conduent client relationship was the source of the data, making it difficult for many recipients to trace the exposure back to a specific state agency or employer.
Why Conduent’s Role Matters
Conduent’s business model is the reason so many people were affected without their knowledge. As described by Tom’s Guide, the company provides printing, mailroom services, document processing, and payment operations for state governments and Fortune 100 corporations alike. Its clients include state Medicaid programs, child support enforcement agencies, unemployment insurance systems, and large corporate HR departments.
This architecture — where a single third-party processor handles data flows for hundreds of government and private-sector entities — creates concentrated risk. A single breach of one vendor’s environment can propagate silently across the data of an entire population that never directly interacted with that vendor.
Victim Response and Next Steps
Conduent is offering one year of free credit monitoring and identity restoration services to affected individuals. The enrollment deadline is April 30, 2026. Those who received notification letters can call an information line at 877-332-1658 (Monday–Friday, 9 a.m.–9 p.m. ET) or visit the company’s breach notification portal.
Security experts broadly recommend that affected individuals:
- Place a credit freeze with all three major bureaus (Equifax, Experian, TransUnion)
- Monitor explanation-of-benefits statements for fraudulent medical claims
- Watch for targeted phishing attempts using the exposed personal details
- Review any financial account statements for unusual activity
A class action lawsuit has been filed in New Jersey on behalf of affected individuals.
What Remains Unknown
Several significant questions remain unresolved. Whether Conduent paid the SafePay ransom has not been disclosed, and neither Conduent nor investigators have confirmed whether the 8 terabytes of stolen data has been published or sold elsewhere. The total number of affected individuals continues to grow as more states complete their review of Conduent’s breach notifications; the 25 million figure should be regarded as a floor, not a ceiling.
It is also unclear how many additional Conduent clients — beyond those states that have filed public disclosures — may have had resident or employee data exposed but have not yet notified affected individuals or state attorneys general.