10 Million Records Exposed in Conduent Health Breach
A data breach at Conduent Business Services has exposed sensitive personal and health information belonging to more than 10 million people, making it one of the largest healthcare data breaches in U.S. history. Dozens of class-action lawsuits are now piling up against the company, with plaintiffs alleging negligence and delayed notification. If you were affected, understanding what happened and what steps to take is more important than ever.
What Happened in the Conduent Breach
According to court filings and reporting from the San Antonio Express-News, the breach occurred over a roughly three-month window between October 21, 2024, and January 13, 2025. During that period, attackers accessed systems belonging to Conduent Business Services, a technology and business services company that handles data processing for government and healthcare clients.
The stolen data includes highly sensitive personal identifiers: full names, home addresses, dates of birth, and Social Security numbers. Millions of those affected are residents of Texas, though the breach spans multiple states. The combination of data exposed is particularly dangerous because it contains exactly the information needed to commit identity theft, open fraudulent accounts, or file false tax returns.
The latest amended complaint in the consolidated litigation was filed on March 18, 2026, and attorneys representing plaintiffs argue that Conduent failed both to adequately protect the data and to notify affected individuals in a timely manner.
Why the Lawsuits Could Result in Record Payouts
Class-action suits involving large-scale data breaches have historically produced significant settlements. The Conduent case stands out for a few reasons.
First, the scale is enormous. With over 10 million affected individuals, even a modest per-person settlement figure would produce a payout in the hundreds of millions of dollars. Second, the delayed notification allegation is legally significant. Most U.S. states have breach notification laws requiring companies to inform affected individuals within a specific timeframe, and violations of those laws can increase liability substantially.
Third, Conduent serves as a third-party processor for government-administered programs, meaning the data it holds belongs to some of the most vulnerable populations, including recipients of public health benefits. Courts and juries have historically been less forgiving when breaches affect people with limited resources to respond to identity theft.
The number of lawsuits continues to grow, and legal observers expect the cases to be consolidated into a single multi-district litigation proceeding. Whether the outcome sets a record will depend on the court's findings on negligence and the company's notification timeline.
What This Means For You
If you received a notification from Conduent or from a state agency that administers benefits through Conduent, your data may be part of this breach. Even if you have not received a notice, it is worth taking precautionary steps now.
The most immediate risk is identity theft. Social Security numbers combined with addresses and dates of birth give bad actors everything they need to impersonate you with financial institutions, the IRS, or government benefit programs. Here is what you should do:
- Place a credit freeze with all three major credit bureaus (Equifax, Experian, and TransUnion). A freeze is free and prevents new credit lines from being opened in your name without your direct approval.
- Set up fraud alerts as an additional layer of protection. A fraud alert requires creditors to take extra steps to verify your identity before extending credit.
- Monitor your financial accounts closely for any unfamiliar transactions or new accounts you did not open.
- Watch for phishing attempts. Criminals who purchase stolen data often follow up with targeted phishing emails or phone calls using your real personal details to appear legitimate.
- Check your Social Security statement at ssa.gov to verify that no one has filed for benefits using your information.
It is also worth noting that this breach did not occur because someone intercepted data traveling across a network. It happened inside a corporate database. No personal privacy tool, including a VPN, would have prevented this breach or protected the records once they were stored in Conduent's systems. The distinction matters because understanding the actual threat helps you respond to it correctly. Credit freezes, fraud monitoring, and careful attention to phishing are the tools that apply here.
Regulated Industries Still Fail at Data Security
One of the harder lessons from the Conduent breach is that operating in a heavily regulated sector does not guarantee that your data is safe. Healthcare and government services are subject to strict federal and state privacy rules, yet breaches of this scale continue to happen. Third-party vendors and data processors are increasingly common targets because they aggregate records from multiple clients, making them high-value targets for attackers.
This is not an argument for fatalism. It is an argument for personal vigilance. The steps above are practical, effective, and mostly free. The Conduent case will work its way through the courts for years, and affected individuals may eventually receive compensation. In the meantime, taking action now limits the damage that can be done with your exposed information.
If you want to understand more about how personal data is collected, stored, and potentially exposed, our guide on [how data brokers collect and sell your personal information] is a useful starting point. For those concerned about what happens to sensitive information in transit, you can also read more about [how encryption works and where it applies].
The Conduent breach is a reminder that data you hand over to institutions, even involuntarily as part of benefit programs, carries real risk. Staying informed and taking concrete protective steps is the most reliable response available to affected individuals right now.
