Conduent cyberattack affects 10.5 million people

Conduent, a major business services provider that operates government and corporate back-office systems, has notified millions of people that their personal information was stolen in a cyberattack that the company says was discovered on January 13, 2025. State filings and company disclosures indicate the breach began on October 21, 2024, and continued until the attackers were removed from Conduent’s network on January 13. Notices submitted to several state attorneys general show the incident affected at least 10.5 million individuals, with Texas accounting for roughly 4 million of those records and Oregon reporting the largest single tally.

Conduent said an unauthorized third party accessed a portion of its IT environment and exfiltrated files containing personal information. Stolen data identified in the company’s reviews and state filings include names, addresses, dates of birth, Social Security numbers, medical information and health insurance details. In an SEC Form 8-K filed in April, Conduent said third-party forensic experts reviewed the files and confirmed they contained personal information associated with the company’s clients’ end users.