Massive Conduent Data Breach Exposes Millions Across U.S.

Breach may be largest in U.S. history, affecting customers of major companies like Blue Cross Blue Shield of Texas.

Published on Mar. 2, 2026

Got story updates? Submit your updates here. ›

A massive data breach at business services company Conduent has exposed the personal information of over 10 million people across the U.S., including many residents in the CSRA region. The breach, which lasted from October 2024 to January 2025, compromised sensitive data like Social Security numbers and medical records. Conduent provides third-party services to major corporations, making it difficult for affected individuals to know the original source of their compromised information.

Why it matters

This breach is potentially the largest data breach in U.S. history, surpassing previous high-profile incidents. It highlights the risks of outsourcing sensitive data to third-party vendors and the need for stronger cybersecurity measures to protect consumer information, especially for companies handling health and financial data.

The details

Conduent discovered the cyber attack on January 13, 2025 and determined that hackers had access to the sensitive data for nearly 3 months. The breach has affected people in several states, including Georgia, South Carolina, New Jersey, New Hampshire, Maine, Massachusetts, and New Mexico. Depending on the individual, the exposed information includes addresses, Social Security numbers, and medical/health insurance data.

  • Conduent discovered the cyber attack on January 13, 2025.
  • Hackers had access to the sensitive data from October 21, 2024 to January 13, 2025.

The players

Conduent Business Services

A company that provides third-party printing, mailroom services and back-office support services to major corporations.

Blue Cross Blue Shield of Texas

A major health insurance company whose customers were affected by the Conduent data breach.

Oregon Department of Justice

Keeps a running count of those affected by the Conduent data breach, which has already surpassed 10 million people.

Got photos? Submit your photos here. ›

What’s next

Those affected can receive free credit monitoring for one year through the breach notification, but must sign up by April 30, 2026 to access the services.

The takeaway

This massive data breach underscores the need for companies to have robust cybersecurity measures in place, especially when handling sensitive consumer data through third-party vendors. It also highlights the importance for individuals to closely monitor their credit reports and financial accounts following a data breach to protect against identity theft.