Back-Office Servicer Reports Data Theft Affects 10.5M

In what could be the largest healthcare hack of the year, Conduent Business Solutions LLC has told state regulators that a breach discovered in January has affected more than 10.5 million patients. Clients affected include Blue Cross Blue Shield of Montana and Humana, as well as an undisclosed number of other organizations.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

The incident could rank as the largest 2025 health data breach, but it was not posted to the U.S. Department of Health and Human Services’ HIPAA breach reporting website on Monday, most likely due to the federal shutdown. Conduent has not disclosed whether the breach affected clients in other sectors besides healthcare.

Conduent did not immediately respond to Information Security Media Group’s requests for additional details about the cyber incident, including the total number of the company’s clients affected, and in which industries.

Parent company Conduent Inc. reported the data security incident to the U.S. Securities and Exchange Commission in April, months after some agencies in several states such as Oklahoma, issued their own public notices that some of their services had been disrupted by the Conduent outage.

In its April SEC filing, Conduent said that on Jan. 13 it experienced an operational disruption and learned that a “threat actor” gained unauthorized access to a limited portion of the company’s environment.

Upon discovery of the incident, Conduent said it activated its cybersecurity response plan with the help of external cybersecurity experts to contain, assess and remediate the incident. “The company restored the affected systems and returned to normal operations within days, and in some cases, hours. The disruption did not have a material impact to the company’s operations.”

The investigation determined that the unnamed threat actor exfiltrated a set of files “associated with a limited number of the company’s clients,” Conduent told the SEC.

“Due to the complexity of the files, the company engaged cybersecurity data mining experts to evaluate the exfiltrated data and was recently informed of its nature, scope and validity, confirming that the data sets contained a significant number of individuals’ personal information associated with our clients’ end users,” Conduent told the SEC in April.

“The company is continuing to further analyze and document the precise and detailed impact of the data exfiltrated, and clients are being informed in order to determine next steps as required by federal and state law,” Conduent told the SEC. “To the company’s knowledge, the exfiltrated data has not been released on the darkweb or otherwise publicly.”

Conduent in sample breach notification letters being sent to customers of Humana and Blue Cross Blue Shield of Montana, said the incident affected Conduent Business Solutions LLC, which provides third-party mailroom and printing services, document processing, payment integrity services and various back-office support services.

Conduent said the undisclosed number of affected Humana customers who’s information was potentially compromised includes their names, treatment date and cost information, and health insurance number.

Humana did not immediately respond to ISMG’s request for comment.

Montana state regulators last week disclosed that they are investigating the data breach affecting 462,000 Blue Cross Blue Shield of Montana members involving Conduent, including why nearly 10 months went by without the insurer notifying the individual breach victims (see: Montana Officials Looking Into BCBS Breach Tied to Vendor).

Conduent provides a wide range of services to businesses and governments in 22 countries and reported $3.4 billion in revenue in 2024 – a 9.8% decline from the previous year. The company in an earnings report filed in August with the SEC said that direct response costs to the cyber incident reached about $25 million for the quarter ending on June 30.

“The company maintains a cyber insurance policy and has also notified federal law enforcement authorities of the incident,” Conduent told the SEC.

Vendor Risk

Conduent is the latest of a long and growing list of third-party vendors serving the healthcare sector at the center of hacking incidents that affect millions of patients.

The largest such incident was the February 2024 ransomware attack on UnitedHealth Group’s IT services unit, Change Healthcare, which not only disrupted thousands of healthcare sector organizations for months, but resulted in a PHI breach affecting 193 million people – an all-time record U.S. health data breach (see: Change Healthcare Now Counts 190 Million Data Breach Victims).

While the Conduent incident was not as large as the Change Healthcare breach, “over 10 million individuals is significant,” said regulatory attorney Rachel Rose. “As healthcare/public health is a critical infrastructure sector, it will likely remain a hot target for cyberattacks,” she said.

The Conduent hack of printing and mailing services underscores the vast range of third parties that handle PHI and pose a systemic risk for major HIPAA breaches, some experts said.

“The HIPAA Privacy Rule applies to all forms of PHI and the Security Rule applies to electronic PHI,” Rose said. “Even if PHI eventually ends up in paper format – such as an explanation of benefits, lab results, etc. – covered entities and business associates need to have adequate policies and procedures, training and technical, administrative and physical safeguards,” she said.

One prudent step is to have a checklist for people sending out information and for IT to be vigilant, including setting up extra technical safeguards “because where that information is captured is a treasure trove for cybercriminals,” she said.

Rose suggested that healthcare sector entities take several measures to be better prepared for potential disruptions and data compromises involving their third parties.

“The first step is identifying the ingress and egress of data, as well as where the data is stored – whether internally or externally. Second, continually ensuring that third parties are keeping up to date with safeguards and that internal applications are being patched and monitored is critical,” she said.

“Lastly, employees need to know what to look for in order to mitigate an attack before it happens. Training on an ongoing basis that is succinct but effective is critical because if too much information is sent out, it gets ignored.”

Wendell Bobst, partner and principal consultant at security and privacy consultancy tw-Security, also suggests that healthcare sector firms take important steps to enhance their vendor risk management programs.

Traditionally these programs have relied on questionnaires and reviews of annual SOC reports. “A risk-tiering structure is needed where organizations must implement continuous vendor monitoring programs for higher-risk vendors,” he said. “Tools to track vendors’ external security posture – for example, SecurityScorecard, BitSight – are needed. Higher risk vendors should be providing certifications beyond SOC 2,” he said. Certification such as Cloud Security Alliance, STAR Registry, HITRUST R2 and FedRAMP should be considered, “as the requirements are more rigid,” he said.

Also, while contract clauses are difficult to negotiate with large vendors, failures of vendor security should be their full responsibility, he said. That means indemnification language in contracts, prompt notification, approval of breach notification letters, and tested disaster recovery and business continuity plans, he said. “Next, the right to request evidence of controls and the right to audit and help when suspicions mount. These require resources to solicit and review the evidence provided.”

Bobst said that it is imperative for organizations to keep accurate vendor registries that include the amount and nature of PHI.

“Initial reports of incidents require healthcare organizations to determine which vendors might have been breached. When possible, data should be tokenized or de-identified before sharing, reducing the impact if a vendor’s environment is compromised. Review the principle of least privilege, only providing what is required.”

Finally, he suggests strong incident response plans that include vendor-specific playbooks and tabletop exercises. “These playbooks should identify contact points, escalation paths, alternate processing methods, and prepared communications for patients and regulators,” he said.