Conduent Data Incident Impacts Priority Health Members

Cybersecurity incident at Conduent, a third-party vendor, leads to delayed notification to Priority Health

Mar. 16, 2026 at 2:36pm

Got story updates? Submit your updates here. ›

Conduent, a vendor for Priority Health, experienced a cybersecurity incident on January 13, 2025. Priority Health was informed of the incident on April 21, 2025, after Conduent completed an extensive analysis of the complex data sets involved. The incident occurred in Conduent's systems and did not involve a breach of Priority Health's own systems. Affected data may include member names, Social Security numbers, medical information, or insurance details.

Why it matters

This incident highlights the risks associated with third-party vendors and the importance of timely notification to affected parties. It also raises questions about data security practices and the potential impact on Priority Health members whose personal and medical information may have been exposed.

The details

Conduent, a third-party vendor that performs post-payment identification and recovery of credit balances/overpayments, primarily at hospitals and renal dialysis facilities, experienced the cybersecurity incident. The delay in notification to Priority Health was due to the extensive and complex data sets that Conduent needed to analyze, followed by the validation and additional requirements necessary once the information was provided to Priority Health.

  • The incident occurred at Conduent on January 13, 2025.
  • Priority Health was informed of the incident on April 21, 2025.

The players

Conduent

A vendor for Priority Health that experienced a cybersecurity incident in its systems.

Priority Health

A health plan in Michigan that was informed of the Conduent incident on April 21, 2025.

Got photos? Submit your photos here. ›

What’s next

Conduent has established a call center for members with questions. Members can call (888) 406-8902 (toll-free), Monday-Friday, from 9 a.m. - 6:30 p.m. Eastern Time.

The takeaway

This incident underscores the importance of robust data security practices and timely communication between third-party vendors and their clients, especially when sensitive personal and medical information is involved. It also highlights the need for continuous monitoring and oversight of third-party vendors to mitigate the risks of data breaches and incidents.