Conduent Business Services confirmed in state regulatory filings that unauthorized actors infiltrated its network between October 21, 2024, and January 13, 2025. The intrusion exposed personal and medical records belonging to more than 25 million Americans. Affected residents can verify their status through official letters mailed from the Secure Processing Center in Suwanee, Georgia, or managed via Kroll portals. Following vendor incidents analyzed in Homeland411’s guide on how to check passport leak and airline PNR breach exposure data, disclosures to the Department of Health and Human Services Office for Civil Rights show cumulative impacts exceeding 62.2 million records. Stolen files contain Social Security numbers, birthdates, medical claim codes, and insurance policy numbers.
Florham Park, New Jersey-based Conduent operates as a government and healthcare business process outsourcing contractor rather than a retail brand. Consequently, millions of recipients do not recognize the company name printed on breach envelopes. The firm manages mailroom fulfillment, Medicaid administration, electronic tolling, and child-support disbursements for state agencies and Blue Cross and Blue Shield carriers. Threat actors tied to the SafePay ransomware group claimed responsibility after exfiltrating 8.5 terabytes of corporate and client records. That single contractor compromise triggered cascading notifications across dozens of covered healthcare entities and state benefit programs.
Never Miss An UpdateFollow us on Google News to get our latest security, defense and cyber reporting in your feed. It’s free and takes one tap.
Follow on Google NewsSecurities disclosures filed with the Securities and Exchange Commission on Form 8-K confirm that Conduent incurred tens of millions of dollars in forensic and notification costs. Unlike account passwords, compromised Social Security numbers and health subscriber IDs remain permanently active across credit bureaus and clearinghouses. Analysts tracking supply-chain cybersecurity risks across government contractors warn that centralized print and billing vendors create concentrated single points of failure. Attackers target these hubs to harvest millions of verified identities in a single operation.
Conduent Data Breach Scope, State Filings, and Kroll Notice Verification
State attorneys general and federal health regulators maintain public ledgers tracking how the October 2024 intrusion spread across regional health plans and state agencies. Texas Attorney General Ken Paxton issued Civil Investigative Demands after state filings confirmed 15.4 million impacted Texans. Oregon regulators separately logged 10.5 million affected residents in state disclosures. Additional filings in Maine, New Hampshire, Massachusetts, and Wisconsin expanded the national tally as client audits concluded. The table below outlines confirmed regulatory filings, exposed data fields, and official verification channels:
| Jurisdiction / Filing Entity | Confirmed Impact | Compromised Data Fields | Official Verification Channel |
|---|---|---|---|
| Texas Attorney General | 15.4M Residents | Name, SSN, DOB, medical claim and insurance IDs | Secure Processing Center mail (Texas AG Portal →) |
| Oregon Dept. of Justice | 10.5M Records | Name, SSN, state benefit and billing files | Mailed Kroll activation code (Oregon DOJ List →) |
| HHS OCR HIPAA Portal | 62.2M Cumulative | Protected Health Information, treatment codes, member IDs | BCBS Texas & Montana notices (HHS HIPAA Rule →) |
| New Hampshire & Maine AGs | Multi-State Plans | Name, SSN, financial account and payment records | Conduent c/o Kroll, Suwanee GA (NH DOJ Filings →) |
How to Verify Secure Processing Center and Kroll Breach Letters Step by Step
Recipients of physical letters referencing Conduent Business Services, the Secure Processing Center, or Kroll should complete four verification steps before submitting personal details online:
- Inspect the Return Address: Verify the envelope lists Secure Processing Center, P.O. Box 3826, Suwanee, GA 30024, or Conduent c/o Kroll, alongside your specific health plan.
- Match State Registry Dates: Confirm the letter cites the October 21, 2024 to January 13, 2025 intrusion window listed on official state attorney general portals.
- Enter Kroll Codes Directly: Type the printed Kroll enrollment URL directly into your browser rather than clicking unsolicited text links or email attachments.
- Lock Federal Credit Files: Activate free credit freezes under FTC credit freeze rules and obtain an IRS Identity Protection PIN.
Why Conduent Notification Letters Reference Kroll and Suwanee Mail Hubs
When a backend processor suffers a multi-state breach exceeding 25 million records, HIPAA business associate agreements mandate individual written notifications. Each letter must identify the covered entity or state agency whose records were exposed. Conduent retained legal administration and fulfillment specialists, including Kroll and the Suwanee, Georgia Secure Processing Center, to print and distribute millions of customized notices. Envelopes bear a “Return to Kroll” or Suwanee P.O. Box instruction so administrators can track undeliverable mail for regulatory compliance audits.
“Our investigation determined that an unauthorized third party had access to our environment from October 21, 2024, to January 13, 2025, and obtained some files associated with certain client operations.”
— Conduent Business Services, LLC, Official State Notice of Data Breach Filing
Forensic teams spent months indexing 8.5 terabytes of unstructured files to match affected individuals with their respective health plans and state agencies. As a result, Conduent dispatched notification letters in staggered waves throughout 2025 and 2026. Two members of the same household covered under Blue Cross and Blue Shield of Texas or state Medicaid programs frequently received mailings months apart. Authentic Kroll notices include a unique activation code for 12 to 24 months of complimentary identity monitoring. Legitimate administrators never demand credit card numbers, banking credentials, or enrollment fees over the phone.
Medical Identity Theft Defenses and Statutory Consumer Protections
Placing a credit freeze with Equifax, Experian, and TransUnion under Fair Credit Reporting Act Section 605A blocks unauthorized lenders from opening new credit accounts. However, credit bureau locks do not stop criminals from exploiting stolen health insurance subscriber numbers. Threat actors use leaked policy identifiers to submit fraudulent clinical billings, acquire prescription medications, or divert durable medical equipment shipments. These credential monetization methods mirror the lateral abuse patterns documented in Homeland411’s report on the DreamHost FTP and webmail credential breach.
Affected policyholders should review every Explanation of Benefits statement from their insurance carrier for unfamiliar clinic visits, laboratory tests, or pharmacy claims. If unrecognized medical charges appear, members should immediately request a replacement subscriber ID number from their insurer’s fraud department. Patients can also file a formal request for an accounting of disclosures under federal HIPAA privacy rules to audit third-party record access. Consolidated federal class-action lawsuits and state attorney general investigations into Conduent’s network segmentation practices remain pending in New Jersey and Texas courts as of November 2026, with no court-approved settlement payout portal announced to date.
