Sedgwick Government Solutions Hit by TridentLocker

Sedgwick Government Solutions Confirms Cyberattack

Claims administration firm Sedgwick has confirmed a cybersecurity incident at its government-focused subsidiary, Sedgwick Government Solutions, after the TridentLocker ransomware group publicly claimed responsibility for stealing approximately 3.4 GB of sensitive data.

Incident Overview

What is Sedgwick?

Sedgwick is a leading claims and productivity management company providing:

• Workers' compensation claims administration
• Disability and leave management
• Property and casualty claims processing
• Government benefits administration

Sedgwick Government Solutions

The affected subsidiary specifically handles:

• Government employee benefits (federal, state, local)
• Workers' compensation for public sector employees
• Disability claims for government workers
• Sensitive personal and medical information

Attack Timeline

What Data Was Stolen?

While Sedgwick has not disclosed specifics, TridentLocker claims the 3.4 GB includes:

Likely Data Types

• Personal Identifiable Information (PII) — Names, addresses, Social Security numbers
• Medical records — Disability and workers' comp claim details
• Financial information — Bank account details for benefit payments
• Employment records — Government employee data
• Internal documents — Contracts, operational procedures

Potential Impact

If the claims are accurate:

• Thousands of government employees could be affected
• Identity theft risk from exposed SSNs and personal data
• Medical privacy violations (HIPAA implications)
• Fraud risk from stolen financial account information

TridentLocker Ransomware Group

Who is TridentLocker?

TridentLocker is a relatively new ransomware-as-a-service (RaaS) operation that emerged in late 2025. Their tactics include:

• Double extortion — Encrypt systems AND steal data
• Dark web leak sites — Publish victim data if ransom not paid
• Targeted attacks — Focus on high-value organizations
• Affiliate model — Multiple threat actors use TridentLocker tools

Known TridentLocker Victims

• Sedgwick Government Solutions (Feb 2026) — 3.4 GB stolen
• Healthcare organizations (Jan 2026) — Multiple small targets
• Manufacturing firms (Dec 2025) — Supply chain attacks

How the Attack Likely Occurred

Initial Access

Typical TridentLocker attack vectors:

• Phishing emails with malicious attachments
• Compromised Remote Desktop Protocol (RDP) credentials
• Exploited VPN vulnerabilities
• Third-party vendor compromise

Attack Chain

1. Initial Compromise — Phishing or credential theft
2. Privilege Escalation — Gain admin access
3. Lateral Movement — Spread across network
4. Data Exfiltration — Steal 3.4 GB of sensitive files
5. Ransomware Deployment — Encrypt systems (if deployed)
6. Extortion — Demand payment or publish data

Impact on Sedgwick

Business Consequences

• Regulatory scrutiny — HIPAA, state data breach laws
• Client trust erosion — Government agencies may reconsider contracts
• Legal liability — Class action lawsuits from affected individuals
• Incident response costs — Forensics, legal, notification expenses

Regulatory Risks

• HIPAA violations — Medical records exposure ($100-$50,000 per violation)
• State breach notification laws — Required to notify affected individuals
• Government contract compliance — May violate federal cybersecurity requirements
• SEC disclosure (if material impact)

Sedgwick's Response

According to Sedgwick's statement:

"Sedgwick recently became aware of a cybersecurity incident involving unauthorized access to certain systems of Sedgwick Government Solutions. We immediately launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement."

Actions Taken

1. Engaged cybersecurity experts — Third-party incident response firm
2. Notified law enforcement — FBI, potentially CISA
3. Launched investigation — Forensic analysis of compromised systems
4. Implementing safeguards — Enhanced security measures

Notable: Sedgwick has not yet confirmed:

• The volume of data stolen
• Whether systems were encrypted
• If ransomware was deployed
• How many individuals are affected

What Affected Individuals Should Do

If you are a Sedgwick Government Solutions claimant or government employee:

Immediate Actions

1. Monitor accounts — Watch for unauthorized transactions
2. Enable fraud alerts — Contact credit bureaus (Equifax, Experian, TransUnion)
3. Freeze credit — Prevent new accounts from being opened
4. Change passwords — If you had a Sedgwick online account
5. Watch for phishing — Scammers may use stolen data for targeted attacks

Long-Term Protection

1. Sign up for credit monitoring — Sedgwick may offer free monitoring services
2. File taxes early — Prevent tax refund fraud with stolen SSNs
3. Review medical bills — Watch for fraudulent medical claims
4. Report suspicious activity — Contact Sedgwick and law enforcement

Lessons for Organizations

This breach highlights critical security gaps in third-party claims administrators:

Key Takeaways

1. Third-party risk — Government agencies must audit vendor security
2. Data minimization — Only collect and retain necessary data
3. Encryption — Protect data at rest and in transit
4. Incident response readiness — Have IR plans for ransomware scenarios
5. Monitoring and detection — Detect exfiltration before encryption

Current Status

Sedgwick's investigation is ongoing. The company has not yet:

• Disclosed the number of affected individuals
• Confirmed whether ransom was paid
• Announced whether data was published on the dark web

TridentLocker's dark web leak site shows Sedgwick as a victim, with sample data posted as proof. The full dataset has not been published, suggesting Sedgwick may still be in negotiations or the ransom was paid.

Broader Implications

For Government Contractors

This breach underscores the risk of supply chain attacks on government services:

• Contractors hold vast amounts of sensitive government employee data
• Many lack the security resources of federal agencies
• Attackers increasingly target third parties to access government data

For Ransomware Evolution

TridentLocker represents the industrialization of ransomware:

• New RaaS groups emerge monthly
• Barriers to entry are lowering
• Double extortion is now standard
• Leak sites add reputational pressure

Sources

• SecurityWeek — Sedgwick Confirms Cyberattack
• Dark Web Informer — Ransomware Attack Update February 2026

Related Reading

• Conduent Breach Balloons to Tens of Millions of Americans
• Conduent Breach Expands: 15.4 Million Texans Affected, 8TB
• ShinyHunters Dumps 5.1 Million Panera Bread Customer