Conduent ransomware breach confirmed to have exposed data of more than 62 million people

On 13 January 2025, Conduent Business Services — the New Jersey-based business-process outsourcing giant spun off from Xerox in 2017 — discovered that intruders had spent nearly three months inside its network. According to the company's disclosures, an unauthorised party maintained access from around 21 October 2024 until the activity was detected and cut off in mid-January 2025. The full scale of the theft only became clear in early July 2026, when the U.S. Department of Health and Human Services' Office for Civil Rights updated its breach portal to show that 62,224,658 individuals were affected — a figure that ranks the incident behind only the 2024 Change Healthcare breach and the 2015 Anthem breach in the history of U.S. healthcare data compromises.

Conduent processes transactions, payments and administrative records on behalf of government agencies, health plans and large employers, which is why a single intrusion at the outsourcer cascaded into one of the largest health-data breaches ever recorded. The exposed information reportedly includes names, Social Security numbers, dates of birth, medical records, and health-insurance details belonging to the customers and members of Conduent's downstream clients. The SafePay ransomware group claimed responsibility, adding Conduent to its data-leak site in January 2025 and asserting that it had exfiltrated roughly 8.5 terabytes of data.

A count that kept climbing

The victim tally grew dramatically over eighteen months of investigation and notification. When the breach was first reported in the autumn of 2025, Conduent estimated that around 10.5 million people were affected. By February 2026 that figure had been revised to roughly 25 million, and the final count posted to the federal breach portal in July 2026 more than doubled it again to over 62.2 million. The escalation reflects the difficulty of identifying every downstream individual whose data a business associate holds on behalf of numerous client organisations.

Why it matters

Because Conduent is a business associate handling protected health information for many clients, the breach is recorded under U.S. health-privacy rules even though Conduent is itself a technology and outsourcing company rather than a hospital or insurer. Conduent has offered affected individuals complimentary credit monitoring and faces multiple class-action lawsuits. The exposure of Social Security numbers, dates of birth and medical information for tens of millions of people creates a durable, long-tail risk of identity theft and medical fraud that will outlast the operational recovery from the ransomware attack itself.