November 6, 2026
Updated: November 6, 2026
About 62 million people's data was stolen from a back-office contractor. What happened, how to check your letter, what to do now and where the settlement stands.
Mohammed Khalil
The Conduent data breach is a cyberattack on a New Jersey contractor that handles printing, mail, documents and payments for health plans and government programs. An unauthorized party had access from October 21, 2024, to January 13, 2025, and stole files holding data on about 62 million people. If you got a letter from Conduent, it is most likely about this incident, even if you have never heard of the company. Freeze your credit, watch your insurance statements and ignore anyone charging a fee for settlement money. No claims are open yet.
This table reflects public records checked on November 7, 2026.
| Question | Short answer |
|---|---|
| What happened? | An unauthorized third party accessed part of Conduent's network and took files tied to its clients |
| When? | Access ran from October 21, 2024, to January 13, 2025, the day Conduent discovered it |
| How many people? | About 62 million; 62,224,658 is the figure reported to federal health regulators |
| What data? | It varies by person: names, Social Security numbers, birth dates, addresses, medical and health insurance details, and in some cases financial account information |
| Has it been misused? | Conduent says it has no evidence of misuse or public posting; we found no regulator finding that confirms or disproves this |
| How did attackers get in? | Conduent has not said publicly |
| Is there a settlement? | A proposed $80 million class settlement is not approved; a hearing is set for December 11, 2026 |
| Can I file a claim today? | No. There is no court-approved claim process yet |
Conduent is a business process services company based in Florham Park, New Jersey. Its notice to the Iowa attorney general describes third-party printing and mailroom work, document processing, payment integrity and other back-office support. Few people choose Conduent directly. Your health plan, a government program or an employer may hire it, which is why the letter can look random. The letter is written on behalf of a client, and the client's name is in it.
Organizations that have publicly linked their members to the incident include Premera Blue Cross, Blue Cross and Blue Shield of Texas, Blue Cross and Blue Shield of Montana and plans run through the Teacher Retirement System of Texas. The Texas attorney general says Texas Medicaid recipients are among those affected.
This is not a full list, because no complete client list is public. Several clients state that their own systems were not breached; the files were taken from Conduent's environment.
Separately, the amended class complaint names AIG Procurement Services, The Cigna Group, Elevance Health, Health Care Service Corporation and Humana. Those are allegations in a lawsuit, and the settlement agreement says it is not an admission by any of them.
Coverage often mixes up three dates: when access began, when Conduent found it and when people were told.
| Date | Event | Source |
|---|---|---|
| October 21, 2024 | Unauthorized access begins | Conduent notices |
| January 13, 2025 | Conduent discovers the incident and secures its network | Conduent notices; SEC 8-K |
| January 2025 | An outage delays child support payments in Wisconsin | Wisconsin agency via press |
| January 22, 2025 | Conduent confirms the outage was a cybersecurity incident | Company statement via press |
| February 2025 | The SafePay ransomware group claims the attack and 8.5 TB of data | The Record |
| April 14, 2025 | SEC 8-K says files were stolen and held many people's data | SEC |
| October 2025 | First regulator filings and mailed letters, starting October 8 and 24 | State filings |
| October 27, 2025 | First class actions; more than 30 follow | Settlement agreement |
| February 12, 2026 | Texas attorney general issues civil investigative demands | Texas AG |
| May 5, 2026 | Missouri regulator says Conduent was unwilling to provide information | Missouri DCI |
| June 2026 | Federal health total reported at 62.2 million | HIPAA Journal |
| October 16, 2026 | $80 million settlement agreement signed and filed | SEC; court |
| October 22, 2026 | Judge asks for more information before ruling | Court order |
| December 11, 2026 | Hearing scheduled on the motion | SEC 10-Q |
Early reporting on the Wisconsin payment delays and Conduent's confirmation shows how this first looked like an outage. Two gaps then explain most of the criticism of the case. The attacker had 84 days of access before discovery. Then 268 days passed between discovery and the first notices about individuals. Conduent attributes the second gap to a "time-intensive data analysis" of complex files, and Blue Cross and Blue Shield of Texas says it also had to verify which participants were affected after receiving the data. Plaintiffs allege the notice was late, and Conduent denies their allegations.
The current figure is about 62 million. The settlement agreement uses "approximately 62 million," and HIPAA Journal reports 62,224,658 on the federal breach portal. Older articles quote smaller numbers because the count kept moving.
| When | Figure | What it counts | Where it appeared |
|---|---|---|---|
| October 2025 | 10.5 million | Initial total | Oregon DOJ |
| October 2025 | About 4 million | Texans only | Texas AG list |
| February 2026 | 15.4 million | Texans only, revised up | Texas AG list |
| February 2026 | 25 million or more | All individuals | Wisconsin DATCP |
| May 2026 | About 12.8 million | Texans only, revised down | Texas AG list |
| June 2026 | 62,224,658 | All individuals | HHS, as reported |
| October 2026 | About 40 million plus 22 million | Settlement subclasses | Settlement agreement |
The Texas figures come from TechCrunch and BankInfoSecurity, which report the state's list. Three things make these numbers hard to read:
Published counts do not support that. Texas Attorney General Ken Paxton called it "likely the largest breach in U.S. history" in February 2026. HIPAA Journal ranks it third among reported healthcare breaches, behind Change Healthcare (192.7 million) and Anthem (78.8 million). For sector context, see our healthcare data breach statistics.
Your letter is the best guide, because the data differs by person and by client. Conduent's notice says the files may include names, Social Security numbers, medical information and health insurance information, and that not every element was present for everyone.
Client notices are more specific. Premera lists treatment or diagnosis descriptions and codes, treatment cost, admission and discharge dates, and member and claim numbers. BCBS of Texas adds provider names and group and subscriber numbers. The settlement agreement's definition also covers addresses, birth dates and financial account information.
The agreement also reveals a split that notices do not mention. About 40 million people's data was stolen in a complex form "not readily accessible" to outsiders, while about 22 million people's data was in readily accessible files. That split affects settlement benefits. The agreement does not say the data was encrypted, so do not treat "complex" as safe.
The SafePay ransomware group claimed the attack in February 2025 and said it took 8.5 TB. Conduent had not verified that claim when it was made, and its SEC filing and notices do not name a group. Treat SafePay's role as a claim.
Conduent has repeatedly said it has no evidence of misuse and, in its SEC filing, that the data had not been released publicly to its knowledge. That is not a guarantee. The FTC notes that a new Social Security number is rarely available, so it makes sense to protect yourself as though yours could be misused later.
Probably, if it arrived by postal mail and matches the filed samples, but check it. The sample letters filed with regulators carry the subject "Notice of Data Incident," name a client, give the October 21, 2024, to January 13, 2025 dates and list the data involved. The return address on the samples is a Secure Processing Center in Suwanee, Georgia, and the written contact is Attn: Data Incident, 100 Campus Drive, Suite 200, Florham Park, New Jersey.
Official sources publish different phone numbers. That alone is not a scam signal, since the lines appear to vary by client or mailing, but it does mean a number on a letter cannot prove much. Compare yours with this list:
| Number | Published by | Hours listed |
|---|---|---|
| 855-403-1589 | Conduent notice page | Weekdays, 9:00 a.m. to 6:30 p.m. ET |
| 855-291-2608 | Sample letter, California AG | Weekdays, 9:00 a.m. to 9:00 p.m. ET |
| 877-332-1658 | Missouri DCI | Weekdays, 9:00 a.m. to 9:00 p.m. ET |
| 855-291-2605 | Wisconsin DATCP | Not listed |
| 866-291-3678 | Teacher Retirement System of Texas | Weekdays, 8:00 a.m. to 8:00 p.m. CT |
| 866-559-4749 | BCBS of Texas FAQ | Weekdays, 8:00 a.m. to 5:30 p.m. CT |
These lines come from the Conduent notice, the California sample, Missouri, Wisconsin, TRS and BCBS of Texas. You can also call the member number on your insurance card and ask whether the plan used Conduent.
Be more suspicious of anything unexpected by phone, text or email. The FTC advises not to respond to unexpected contacts or click their links, and to look up the organization's number yourself. Breaches like this one give scammers believable details for social engineering.
One catch in the letter itself. The sample says an initial fraud alert lasts 90 days and describes a freeze process with mailed documents and possible payment, while also calling a freeze free. Current FTC guidance says a fraud alert lasts one year and that placing or lifting a freeze costs nothing. Follow the FTC.
Start with the data types your letter names. These steps come from the FTC's checklist for exposed information unless noted.
| If your letter lists | Do this |
|---|---|
| Any personal data | Get free credit reports, freeze credit at Equifax, Experian and TransUnion, and keep checking your reports |
| Social Security number | Review your work history in a my Social Security account, consider an E-Verify lock, and file taxes early |
| Medical information | Read every Explanation of Benefits; if something is wrong, request records and report errors in writing |
| Health insurance details | Tell your insurer, Medicare or Medicaid office, and ask for a replacement card if needed |
| Bank or investment account | Contact the institution on a number you trust; the FTC advises closing the account and opening a new one |
| Debit or credit card | Ask the issuer to cancel the card and send a new one |
A few details are easy to miss:
Your letter may list something else, such as a driver's license or SNAP card. The same FTC checklist covers those too, and our identity theft statistics show how these crimes play out.
No letter does not prove your data was safe. Conduent told reporters its notifications were effectively complete by mid-2026, but addresses go stale. If you think you were covered, call one of the lines above or your plan.
Do not rely on a breach-lookup site. Have I Been Pwned had no Conduent entry when we checked on November 7, 2026, which fits Conduent's statement that the data has not been posted but tells you nothing about your own record. A credit freeze is free and sensible either way.
Conduent's latest quarterly report, filed November 5, 2026, says it is responding to subpoenas, information requests and investigations from government agencies and others. We found no published fine or final enforcement outcome as of November 7, 2026.
On costs, Conduent reports a $25 million charge in early 2025 tied to notification requirements.
This is general information, not legal advice. The case is In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, in federal court in New Jersey.
Conduent signed an $80 million agreement on October 16, 2026, without admitting fault, and says its insurers will fund it. On October 22, the judge did not grant preliminary approval. He asked for more on the risk of proving liability, total possible damages, the value of monitoring and leftover funds, and noted the proposed notices were only in English. New materials were due November 5, and we could not confirm what was filed. Conduent reports a December 11, 2026 hearing.
The proposed terms could still change:
| Term | Proposed |
|---|---|
| Who is covered | US residents on the class list who received actual or substitute notice |
| Monitoring | One year, automatic: credit monitoring for about 40 million (Subclass A), medical data monitoring for about 22 million (Subclass B) |
| Documented losses | Up to $3,500 per person for unreimbursed losses from fraud or identity theft, with proof, for anyone in the class |
| Cash payment | Equal shares of what remains, for Subclass B members who file a valid claim |
| California | Subclass B residents of California on October 21, 2024 get 20% more |
| Fees and awards | Lawyers may seek up to 34% plus costs; class representatives up to $1,500 each |
| Timing | Notice within 40 days of preliminary approval; claims due 75 days after notice starts; opt-outs and objections due at 90 days |
Nobody can say yet, and the agreement says the amount will not be known until claims are validated and the court rules on fees. As rough arithmetic, $80 million across 62 million people is about $1.29 each, before fees, monitoring costs and administration. That is not a payment estimate, because only some people would file and only Subclass B could claim the equal-share cash. The $50 and $60 figures in the agreement are an illustration of the California adjustment, not a forecast.
As of November 7, 2026, there was nothing to file. The agreement says the settlement website would go up shortly before notice begins, and it proposes Epiq as administrator, subject to court approval. Treat any current "Conduent settlement" form as suspect. The proposed fund covers administration and legal fees, so a demand for payment is a red flag.
Real notice would come by email with an activation code, which is exactly what a scam would imitate. Following the FTC's advice, do not click through. Confirm the settlement site from court or SEC records first, then type the address yourself.
The public record does not say how attackers got in, so any claim that a particular control would have stopped this is a guess. The useful lessons are about the vendor chain. A mailroom vendor can hold more sensitive data than a software vendor with a login to your network.
| Question to ask | What this case shows | How to validate it |
|---|---|---|
| Which vendors hold our people's data, including back-office ones? | Print, mail and payment work carried Social Security and medical data | Map data flows and tier vendors by data held, not network access |
| Could a vendor tell us within days whose data was in stolen files? | Review took months and clients then re-verified members | Run a vendor tabletop with a sample file set |
| Would large outbound transfers be noticed? | Access lasted 84 days and files left the network | Test exfiltration detection in an authorized exercise |
| Who notifies, who pays and who talks to regulators? | Letters went out for clients; Missouri asked licensees directly | Put roles and deadlines in contracts and the response plan |
| Do we know what sits in archives and processing files? | About 40 million records were in complex files that took experts to interpret | Have testers look for sensitive data in shares and archives |
HIPAA already sets part of this. A business associate must notify the covered entity after a breach, no later than 60 days from discovery, and HHS's contract guidance requires safeguards and reporting in the agreement. Whether anyone missed a deadline here is for regulators and the court. For a wider framework, NIST SP 800-161 covers supply chain risk, and our guides on the third-party risk management lifecycle and third-party risk statistics go deeper.
Testing helps where you control the environment. An internal penetration test shows what an intruder could reach and which sensitive files sit unprotected. Purple teaming and breach and attack simulation check whether your team sees data leaving. Pair them with a current incident response plan, and see our HIPAA penetration testing guide if you handle health data. Testing does not guarantee you will avoid a breach or meet a compliance rule.
Yes. Conduent disclosed it in an SEC filing and in notices to state regulators. A mailed letter from Conduent is likely genuine, but verify the details against the filed samples and the official numbers above, and do not trust unexpected calls, texts or emails.
A mailed letter is the main signal, and it lists your data types. No public lookup tool exists that we could verify. If you have coverage through a health plan or a government program that used Conduent, call the plan or one of the official lines listed above.
Conduent is a publicly traded business process services company headquartered in New Jersey. It provides printing, mailroom, document processing, payment integrity and other back-office services for commercial and government clients.
That is unknown, and the settlement is not approved. The proposal offers up to $3,500 for documented losses, automatic monitoring for one year and a share of remaining funds for people in Subclass B who file valid claims. Amounts depend on the number of claims and on court decisions.
No. Credit freezes, fraud alerts and the IRS PIN are available now, regardless of when your letter arrived or whether the monitoring offer expired.
If you got a letter, start with the credit freeze, then work through the table above. Those steps do not depend on what happens in court.
If you run security or vendor risk, test one assumption: that you would find out quickly, with enough detail to act. DeepStrike's penetration testing services include infrastructure testing and red team engagements, with every assessment conducted manually. Contact DeepStrike if you want help scoping that work.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
