Regulators Want to Know If Insurer Delayed Notifying 462,000 Affected Members
Montana state regulators are investigating a data breach affecting 462,000 Blue Cross Blue Shield of Montana members involving one of the health insurer’s third-party services providers – and they want to know why nearly 10 months have gone by without notifying the breach victims.
See Also: The Rise of Agentic Commerce: Building Secure, Trusted Payments for the AI-Driven Economy
It took nearly four months for the insurer’s vendor, Conduent, to notify federal regulators about the incident that was detected in January 2025. The company said the breach affected a “significant number” of people.
Blue Cross Blue Shield of Montana in a statement to Information Security Media Group said Conduent notified the health insurer that some member data was affected, but did not disclose when it was notified by Conduent.
It its statement, Blue Cross Blue Shield Montana said its systems were not affected by this incident, but “because of our relationship with Conduent, BCBSMT members were impacted by Conduent’s incident. Conduent will be mailing letters to impacted members.”
Florham Park, New Jersey-based Conduent Inc., a publicly traded company formed in 2017 in a divestiture from Xerox, provides mailroom, payment and other back-office support services to Blue Cross Blue Shield of Montana.
“If a BCBSMT member’s data has been impacted by this incident, it is due to BCBSMT’s relationship with Conduent. We are committed to supporting our members and working with them through this incident.”
The health insurer did not immediately respond to ISMG’s request for addition details about the data breach.
State Investigation
A Montana state spokesman told ISMG that the state auditor’s office is investigating the breach in part to determine whether Blue Cross Blue Shield of Montana delayed reporting the incident to the state and notifying affected members. BCBSMT reported the breach to Montana authorities on Oct. 8, he said.
Under Montana state law, entities are required to report major data breaches to the state “without reasonable delay,” he said.
If the state’s insurance commissioner’s office determines that a company has violated data breach reporting requirements, state regulators have the authority to impose up to $25,000 in fines per violation, he said.
Conduent reported its data security incident to the U.S. Securities and Exchange Commission in April, months after some of its other clients – including agencies in several states such as Okahoma – issued their own public notices that some of their services had been disrupted by the Conduent outage.
Conduent in its April SEC filing said it experienced an operational disruption on Jan. 13 and learned that a “threat actor” gained unauthorized access to a limited portion of the company’s environment.
The company said it activated its cybersecurity response plan, and with the help of external cybersecurity experts, restored the affected systems and returned to normal operations within days, “and in some cases, hours.” The disruption did not have a material impact to Conduent’s operations, the company said.
Conduent’s investigation found that the threat actor exfiltrated a set of files associated with “a limited number” of the company’s clients.
“Due to the complexity of the files, the company engaged cybersecurity data mining experts to evaluate the exfiltrated data and was recently informed of its nature, scope and validity, confirming that the data sets contained a significant number of individuals’ personal information associated with our clients’ end users.”
Conduent did not immediately respond to ISMG’s request for additional details about the incident, including the number of clients and people affected, and the identity of the cybercriminals behind the attack.
“To the company’s knowledge, the exfiltrated data has not been released on the darkweb or otherwise publicly,” Conduent said in its April filing to the SEC.
Conduent provides a wide range of services to businesses and governments in 22 countries and reported $3.4 billion in revenue in 2024 – a 9.8% decline from the previous year. The company’s earnings report for the quarter ending on June 30 indicate that direct response costs to the cyber incident reached about $25 million.
“While the company did not experience material impacts to its operating environment or costs from the event itself, the company has incurred and accrued material non-recurring expenses in the first quarter related to the event based on potential notification requirements,” Conduent said. “The company maintains a cyber insurance policy and has also notified federal law enforcement authorities of the incident.”
Conduent also recently reported the data breach to various state regulators – including California’s attorney general’s office on Oct. 8.
The Montana state spokesman told ISMG that state officials do not know at this time whether any other Montana companies were affected by the Conduent incident, “but we are aware that the Conduent breach was extensive.”