The 2024-2025 intrusion at Conduent Business Services is now counted among the largest healthcare-related data breaches on record. Coverage citing The HIPAA Journal puts the number of affected people at more than 62.2 million. Delist reports the exact figure as 62,224,658, taken from Conduent's updated filing with the HHS Office for Civil Rights (OCR) and first reported by The HIPAA Journal in June 2026. This is not a new attack. It is a new count for an incident Conduent found on January 13, 2025. Over 20 months the count has grown in stages: earlier totals from individual states, then interim figures of about 10.5 million and 25 million, and now the HHS number. Not every source has caught up. As of October 6, 2026, Verity Daily cites Wisconsin's breach registry as listing more than 25 million affected. Conduent's own securities filings have never given a total count. Its latest 8-K, filed September 10, 2026, is about lawsuits, not victim numbers.
What Happened
The core timeline is consistent across the sources:
- October 21, 2024: Unauthorized access to Conduent's environment begins, according to L.A. Care's client notice and the Conduent notices compiled by Delist.
- January 13, 2025: Conduent has what it called an "operational disruption" and finds that a threat actor has reached "a limited portion" of its environment. This is quoted from Conduent's April 2025 8-K as reproduced by Tutela Digitalis. The company says systems were restored "within days, and in some cases, hours."
- April 2025: Conduent discloses the incident to the SEC. Tutela Digitalis dates this filing to April 14, 2025, under Item 1.05. The filing says the stolen files belonged to "a limited number of the Company's clients" but held personal information on "a significant number" of those clients' end users.
- October 2025 onward: Notification letters go out. Tutela Digitalis reports that Conduent told the SEC in August 2026 that notifications "began in October 2025 and have been substantially concluded."
- June 2026: Per Delist's account of HIPAA Journal reporting, Conduent's updated report to HHS OCR puts the total at 62,224,658 people.
- August 2026: Downstream clients are still notifying people. L.A. Care Health Plan sent member notices on August 28, 2026, more than 19 months after Conduent discovered the breach. L.A. Care said Conduent needed time "to thoroughly analyze the affected files" before it could inform the plan.
- September 10, 2026: Conduent files an 8-K under Item 8.01. According to Stocktitan's summary, it says Conduent reached an agreement in principle in August 2026 to settle In re: Conduent Business Services Data Breach Litigation, the consolidated case in the U.S. District Court for the District of New Jersey. The settlement still needs court approval. Conduent denies the allegations, says it carries cyber insurance, and does not expect a material financial impact.
Why the victim counts differ: The figures are not in direct conflict. They come from different reporting channels at different points in time. State registries and attorney general filings record the residents of one state or the people tied to one client. The HHS OCR figure covers protected health information nationwide. Delist warns that rows on the OCR portal "can lag or show interim counts." Readers should treat 62.2 million as the current regulatory figure, and should not expect individual state registries to match it.
What Was Taken
Conduent processes data for its clients, so what was exposed depends on the client. L.A. Care's notice is the most detailed first-party list available. It covers:
- Name and date of birth
- Claim number, date of service, and treatment cost
- Date of admission, type of treatment, and discharge details
- Health insurance member information
- Social Security numbers, in fewer than five cases for L.A. Care members
L.A. Care notes that "not every data element was present for every individual." That SSN figure applies only to L.A. Care's members and should not be applied to the full 62.2 million. Tutela Digitalis reports that some recipients' letters mention Social Security numbers and include an offer of credit monitoring, so for other clients the data set clearly includes more identity data. Conduent works for health plans, providers, and government agencies, and Delist lists its services as printing, mailing, document processing, and payment integrity. That makes it likely the data mix varies a lot from one client to the next. No source gives a full breakdown of data types across the entire affected population.
Why It Matters
Third-party concentration risk. Conduent's own filing says the files came from "a limited number" of clients. That small set of clients still added up to more than 62 million people. Many of those people had never heard of Conduent, a point Tutela Digitalis and Verity Daily both stress. Back-office vendors that combine data from many health plans and agencies are high-value targets, and one compromise reaches across every client they serve.
Scale relative to the sector. Delist reports that HIPAA Journal and Paubox place the breach third among healthcare breaches, behind Change Healthcare and Anthem. This comes at a time of high breach volume overall. HIPAA Journal's statistics show a record 772 large breaches reported to OCR in 2025.
Notification lag carries its own risk. Conduent found the intrusion in January 2025. Its notifications began in October 2025, and clients such as L.A. Care were still sending letters in August 2026. During that gap, stolen data can be used for months before the people affected know about it. Tutela Digitalis also notes that searches for "Conduent letter" are still rising after the official wave of notifications ended. Scammers can exploit that, so recipients should verify any letter through an independent channel.
The financial fallout looks contained, for now. CIO Monitor stresses the litigation and contract liability that follow a breach this large. Even so, Conduent's September 2026 8-K says it expects the class action settlement to be covered without material impact, pending court approval. Any separate claims from clients or regulators are not covered by that filing.
The Attack Technique
The sources do not identify how the attacker got in. None of the eight sources names a threat actor, a ransomware family, or an initial access vector. Conduent's public statements describe a "threat actor" and an "operational disruption" that interrupted services, then say files were taken. That pattern is consistent with an extortion-style intrusion, but no source here confirms it. What the sources do establish:
- Dwell time of about 12 weeks (October 21, 2024 to January 13, 2025) before detection.
- The intrusion was found through disruption, not proactive detection. Conduent learned of it when operations were affected.
- Data was exfiltrated. L.A. Care's notice says the attacker "obtained certain files."
- Response: According to client notices, Conduent secured its network, notified law enforcement, and brought in outside forensics firms.
We will update this brief if Conduent or law enforcement attribute the attack.
What Organizations Should Do
- List every vendor that holds regulated data in bulk. That includes print and mail providers, claims processors, and payment integrity vendors, not only core IT suppliers. Each one is a possible 60-million-record exposure.
- Put notification deadlines in business associate agreements. Set contractual deadlines for the vendor to notify you and to deliver its analysis of affected files. L.A. Care's 19-month gap shows what happens when the vendor alone controls the timeline.
- Minimize what you send vendors. Send only the fields a vendor needs for the service, and require deletion or return of data when the contract ends. L.A. Care calls Conduent a "former vendor," which raises the question of why member data was still held after the relationship ended.
- Plan for a vendor dwell time of 90 days or more. Ask vendors for evidence of detection coverage, not just recovery capability. Conduent restored operations within days but did not detect the intrusion for 12 weeks.
- Prepare your own notification process ahead of time. Under HIPAA, the covered entity still owns the duty to notify, even when the vendor files the report. Pre-draft member communications and keep verification guidance ready so recipients can tell real letters from phishing.
- Monitor misuse of claims data. Claim numbers, treatment details, and member IDs support medical identity fraud and convincing phishing. Flag unusual claims activity and member-service requests for the populations affected.
Sources: Conduent Data Breach Tops 62.2 Million Individuals — CIO Monitor | CONDUENT Inc Form 8-K filed September 10, 2026 | Healthcare Data Breach Statistics – Updated for 2026 | L.A. Care Issues Notice of Data Breach Involving Former ... | Why Did You Get a Conduent Letter? Tutela Digitalis | Conduent data breach (2025): what was exposed and what to do Delis... | Conduent Data Breach: What Happened and What to Do Now | Conduent details data breach settlement in principle CNDT 8-K Filing