The repercussions of a ransomware incident targeting one of the largest government contractors in the U.S. continue to escalate: over 25 million individuals have had their personal information compromised in the breach.

Conduent offers printing, mailroom services, and document and payment processing for state government benefit programs, including food assistance as well as workplace and unemployment benefits for major companies. Consequently, the organization manages a significant volume of personal data belonging to a wide array of U.S. residents. Conduent claims its technology and operational support services affect over 100 million individuals.

However, following the January 2025 cyberattack that a ransomware group has taken responsibility for, the corporation has disclosed little regarding the data breach, including its causes and the number of individuals impacted.

An update on the data breach notification page for the state of Wisconsin now indicates that the Conduent breach impacts at least 25 million individuals throughout the United States.

TechCrunch’s ongoing count derived from various data breach notification letters has also reached approximately 25 million individuals, with the bulk of the affected being from Oregon (10.5 million) and Texas (15.4 million). Additional data breach notifications reported by TechCrunch involve several hundred thousand individuals across Massachusetts, New Hampshire, and Washington.

The breach is known to have compromised names, birthdates, addresses, Social Security numbers, health insurance details, and medical information.

Conduent has offered scant information beyond its data breach notifications and, in certain instances, has complicated the process for affected individuals to learn about the breach.

A segment on Conduent’s website, entitled “Incident Notice,” published in October 2025 alongside its initial data breach notification, does not clearly reference a cybersecurity incident. The page includes a concealed “noindex” tag in its source code, instructing search engines not to include the page in search results, thus making it challenging for users searching online to locate it.

When contacted by TechCrunch, Conduent representative Sean Collins declined to disclose how many notifications the company has issued thus far or the reasons for obscuring its incident notice from search engines.

Conduent’s breach has been characterized as one of the “largest ever,” though it likely falls behind the Change Healthcare hack, which impacted over 190 million individuals after a ransomware attack in February 2024. A Russian-speaking ransomware group acquired extensive health and medical data from Change Healthcare using a stolen credential that lacked multi-factor authentication security, leading the healthcare technology firm to pay at least two ransoms to prevent the majority of the stolen data from appearing online.