Government contractor Conduent has experienced a data breach that potentially affected over 10 million Americans. The intrusion was discovered in January 2025, but hackers had access to Conduent's systems from October 21, 2024, for nearly three months.
During this period, sensitive personal information was stolen from various state-level programs managed by Conduent, including Medicaid, child support, and toll systems. The breach compromised data such as Social Security numbers, medical records, and health insurance details for at least 400,000 individuals, with the total number of affected people estimated to be over 10 million.
The attack caused operational disruptions in multiple states, preventing parents from processing child support and welfare payments. The ransomware group SafePay claimed responsibility for the attack, stating they exfiltrated 8.5 terabytes of data.
Conduent confirmed that files belonging to a limited number of clients were taken and that the investigation found significant amounts of personal information. The company has hired cybersecurity experts, is sending notification letters to impacted individuals, and has established a dedicated call center.
Conduent states there is currently no evidence that the stolen data has been published online or on dark web marketplaces.
