Full Breakdown
Massive Data Breach at Conduent Exposes Sensitive Information of 25 Million Americans
2/9/2026, 11:42:34 PM
Overview of the Data Breach
In a significant cybersecurity incident, Conduent, a New Jersey-based technology contractor, experienced a data breach that has affected at least 25 million Americans, including approximately half of Texas' population. The breach, which involved the exposure of sensitive information such as Social Security numbers and health insurance data, began in October 2024 and remained undetected until January 13, 2025.
Scale of the Impact
The breach's ramifications have been particularly severe in Texas, where the estimated number of affected individuals was revised from 4 million to 15.4 million, marking a staggering 285% increase. Additionally, Oregon reported that around 10.5 million residents may have had their data compromised. Other states, including Delaware, Massachusetts, and New Hampshire, are also believed to have hundreds of thousands of victims.
Legal Consequences
The data breach has prompted a series of class action lawsuits against Conduent, which are currently consolidated in federal court in New Jersey. Plaintiffs accuse the company of failing to adequately protect sensitive personal and health data and of delaying notification to victims after the breach was discovered. A plaintiffs’ steering committee was appointed in December 2025 to manage the litigation, which could result in substantial damages and regulatory penalties for Conduent, as well as long-term repercussions with state government clients.
Operational Context
Conduent plays a critical role in managing backend systems for state governments across 46 states, handling essential services such as Medicaid claims, child support payments, food assistance, and unemployment insurance. The company processes over 500 million Medicaid claims annually and disburses tens of billions of dollars in public benefits. The breach was executed by the SafePay ransomware group, which claimed responsibility and stated that it extracted approximately 8.5 terabytes of data from Conduent's systems.
Financial Implications
The financial impact of the breach on Conduent has been severe. The company's stock, which peaked at over $23 per share in 2018, has plummeted by 90%, trading at around $1.50 per share as of early February 2026. Neither Conduent nor SafePay has confirmed the amount of any ransom demand, and the company has not disclosed whether it engaged with the hackers.
Criticism and Response
Critics have raised concerns about Conduent's cybersecurity measures and its response to the breach. The delay in notifying affected individuals has been a focal point of the lawsuits, with plaintiffs arguing that timely communication is essential in mitigating the impact of such breaches.
What's Next
As investigations continue, the outcomes of the lawsuits and the potential regulatory actions against Conduent will be closely monitored. The incident underscores the vulnerabilities faced by organizations handling sensitive data and the importance of robust cybersecurity protocols.
