Conduent data breach: what happened and what to do

What happened

Conduent Business Services runs back-office work for governments and large companies: benefits processing, payments, claims and customer service. That means it holds data on people who never dealt with Conduent directly, such as members of a health plan or recipients of a state program.

According to security reporting on Conduent's filings, an unauthorized party had access to Conduent's systems from October 21, 2024 to January 13, 2025. The California Attorney General's breach list gives October 21, 2024 as the start of the incident, and Conduent's notice to California was published in January 2026. A ransomware group called SafePay claimed the attack in February 2025, but Conduent has not named an attacker.

How many people

The count has grown as notices were filed. A notice filed with the Oregon Attorney General listed 10,515,849 people, with Texas the largest state at around 4 million. One outlet later reported a total above 25 million, with the Texas figure revised up to 15 million. That higher number comes from a single report and we haven't seen it in a state filing, so treat 10.5 million as the confirmed floor.

What was exposed

Conduent's notices say the information involved can include names, Social Security numbers, dates of birth, and health insurance or medical information. Not every person had every item exposed. Conduent says it is not aware of any attempted or actual misuse of the data.

What that lets criminals do

A name, date of birth and Social Security number together are what a lender asks for. With them, someone can apply for a credit card, a loan or a phone plan in your name, or file a fake tax return to claim your refund. Unlike a password, you can't change these details, so the risk lasts for years rather than weeks.

Health insurance details add a second problem: medical identity theft. Someone uses your plan information to get care or prescriptions, and the bill or a false entry lands in your record. The first sign is often an explanation of benefits statement for a service you never received.

Because the data came from a vendor, the letter you get may name a company you've never heard of. That also makes scams easy: criminals send fake "breach notification" messages with a link to claim protection, and they look believable.

The company's response

Conduent began mailing notices to affected people in waves across states, and it encourages people to get free credit reports, place fraud alerts and set up security freezes. Reports differ on whether free identity protection is offered, and the details vary by notice version, so rely on the letter you received. The phone number in your letter is the safe one to use. Don't call a number from a text or email.

If you got a letter

Treat it as real but verify the contact details through Conduent's own website. If you didn't get a letter but your employer, health plan or state benefits program used Conduent, it's still worth freezing your credit, since notices have gone out over many months and across many states.