Conduent Cyberattack Exposes 10.5 Million in 8th Largest U.S. Healthcare Data Breach

Conduent Inc., a leading provider of business process management and technology services, disclosed on October 24, 2025, that [a cybersecurity incident at its third-party vendor](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) had exposed sensitive personal data of over 10.5 million individuals, marking one of the largest healthcare data breaches in U.S. history. The breach, linked to Conduent's services for Blue Cross Blue Shield of Texas (BCBSTX), [involved unauthorized access to systems from October 21, 2024, to January 13, 2025](https://www.red94.com/conduent-cyberattack-10-5-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do/), during which hackers accessed files containing Social Security numbers, dates of birth, addresses, and health insurance details. While no confirmed misuse of the data has been reported, [the company has offered affected individuals 24 months of free credit monitoring](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) and identity restoration services through Kroll.

Timeline and Scope of the Breach

The breach was first detected in January 2025, though the unauthorized access began in late 2024. Conduent confirmed that [the incident impacted clients across multiple states](https://www.red94.com/conduent-cyberattack-10-5-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do/), including 4 million residents in Texas, 1 million in Oregon, and 200,000 in Montana, with additional states affected but not specified.

The data breach has been classified as [the eighth largest in U.S. healthcare history](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html), with exposed information including names, Social Security numbers, and medical records.

Financial and Legal Implications

Conduent has already incurred $25 million in direct response costs, including $9 million in disbursements by September 2025 and an additional $16 million projected by early 2026. [Analysts predict the total cost could exceed $50 million](https://www.red94.com/conduent-cyberattack-10-5-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do/), when accounting for litigation, settlements, and remediation efforts. Multiple class-action lawsuits have been filed, [alleging the company failed to implement adequate security measures](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) despite handling sensitive healthcare data.

Response and Mitigation Measures

The company is providing affected individuals with free credit monitoring and identity restoration services for three years. Affected customers are advised to [monitor credit reports, place fraud alerts with major credit bureaus](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) (Equifax, Experian, TransUnion), and [file reports with the Federal Trade Commission](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) if identity theft is suspected. Conduent also emphasized the need for ongoing risk management, warning that [future litigation, regulatory actions, and reputational harm](https://www.red94.com/conduent-cyberattack-10-5-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do/) could further impact its financial condition.

Affected States and Notification Process

The breach notification process has placed significant operational and financial burdens on Conduent. Texas, Oregon, and Montana have been identified as the most affected states, [with residents notified via letters detailing the incident](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) and mitigation steps. The company's response includes enrolling customers in Kroll's identity monitoring program by March 2026 and providing guidance on accessing free credit reports under U.S. law.

Legal and Regulatory Scrutiny

The incident has drawn attention from state attorneys general and privacy advocates, [with calls for stricter cybersecurity regulations](https://www.red94.com/conduent-cyberattack-10-5-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do/) for third-party vendors in healthcare. Conduent's disclosure of the breach and its financial disclosures highlight the growing risks associated with data management in the sector.

What Affected Individuals Can Do

Consumers impacted by the breach are advised to:1. Enroll in Kroll's identity monitoring program via enroll.kroll.com/redeem using the activation code from their notification letter.2. Request free annual credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com.3. Place fraud alerts with credit bureaus by contacting any one of the three agencies.4. File a report with the FTC at IdentityTheft.gov if identity theft is suspected.

The incident underscores the critical need for robust cybersecurity frameworks in third-party service providers, particularly those handling sensitive healthcare data. [Conduent's response, while proactive, highlights the broader challenges](https://www.masslive.com/business/2025/12/11/conduent-cyberattack-105-million-hit-in-8th-largest-healthcare-data-breach-in-us-what-affected-people-can-do.html) in mitigating the fallout from large-scale data breaches in an increasingly interconnected digital landscape.