Conduent Breach Expands: 15.4 Million Texans Affected, 8TB

Executive Summary

The fallout from the January 2025 ransomware attack on Conduent, one of the largest government technology services providers in the United States, continues to expand dramatically. As of February 2026, the breach is now confirmed to affect at least 15.4 million people in Texas alone — roughly half the state's population.

The Safeway ransomware gang claims responsibility, stating they exfiltrated over 8 terabytes of sensitive data.

Breach Timeline

Jan 2025    — Conduent systems compromised by Safeway ransomware group
Jan 2025    — Initial disclosure: "cybersecurity incident" affecting some systems
Mid 2025    — Investigation reveals scope far larger than initially reported
Late 2025   — Breach notifications begin rolling out to affected individuals
Feb 2026    — Texas confirms 15.4 million residents affected
Feb 2026    — Safeway gang claims 8TB+ of stolen data

What Was Stolen

The stolen data includes some of the most sensitive categories of personal information:

Scale of Impact

• 15.4 million confirmed affected in Texas alone
• National impact likely significantly higher (Conduent operates across multiple states)
• One of the largest government-adjacent data breaches in U.S. history

Who Is Conduent?

Conduent is a $3.5 billion government technology services provider that processes:

• Government benefit programs — Medicaid, SNAP, child support
• Health and human services — Case management, eligibility determination
• Transportation — Tolling, parking, transit fare collection
• HR services — Payroll, benefits administration

The company processes sensitive data for government agencies across dozens of states, making it a high-value target for ransomware operators.

Supply Chain Risk in Focus

This breach is a case study in third-party vendor risk:

The Chain of Trust

Citizens → Government Agency → Conduent (processor) → Breach
 
15.4M+ individuals trusted their state government with sensitive data.
The state trusted Conduent to handle it securely.
Conduent was compromised.

Similar Government Vendor Breaches

Lessons for Security Teams

Third-Party Risk Management

1. Vendor security assessments — Conduct regular security reviews of vendors handling sensitive data
2. Data minimization — Limit the data shared with third parties to what's strictly necessary
3. Contractual protections — Require breach notification within 24-48 hours, not months
4. Monitoring — Implement monitoring for data exfiltration from vendor-connected systems
5. Backup processors — Identify alternative vendors that can assume operations during an incident

Incident Response

• Assume breach notification delays — Plan for the reality that vendor breach disclosures often come months after the actual compromise
• Identity monitoring — Offer affected individuals credit monitoring and identity theft protection
• Regulatory compliance — Understand notification obligations under state data breach laws

For Affected Individuals

If you receive a breach notification from Conduent or your state agency:

1. Freeze your credit with all three bureaus (Equifax, Experian, TransUnion)
2. Monitor benefit accounts for unauthorized changes
3. Enable fraud alerts on financial accounts
4. File an identity theft report if you notice suspicious activity
5. Take advantage of offered monitoring — Most notifications include free credit monitoring

The Ransomware Supply Chain Playbook

Ransomware groups have learned that targeting infrastructure providers creates maximum leverage:

• One breach → millions affected — Conduent processes data for entire state populations
• Government data = high value — SSNs, medical records, and benefit information command premium prices
• Regulatory pressure — Government contracts mean additional compliance obligations and public scrutiny
• Payment incentive — Disrupting government services creates urgency to pay

Sources

• TechCrunch — Conduent Breach Balloons, Affecting Millions More
• SharkStriker — Top Data Breaches of February 2026

Related Reading

• Conduent Breach Balloons to Tens of Millions of Americans
• Covenant Health Ransomware Attack Impacts 478,000 Patients
• Sedgwick Government Solutions Hit by TridentLocker