Conduent data breach: why you got a notice and what to do

What was made public

Conduent Business Services, LLC is not a brand most people deal with directly. In its notice to the Iowa Attorney General, it describes itself as a provider of third-party printing and mailroom services, document processing, payment integrity services, and other back-office support.

According to that notice, dated October 24, 2025, Conduent discovered on January 13, 2025 that it had been the victim of a cybersecurity incident affecting a limited portion of its network. The company says it secured its networks and brought in third-party forensics experts. The investigation found that an unauthorized third party had access to its environment from October 21, 2024 to January 13, 2025.

Conduent's SEC filing from April 2025 gives a similar account. It says the company had an operational disruption on January 13, 2025, found that a threat actor had gained access to a limited part of its environment, and restored affected systems within days, and in some cases hours. The filing also says the company notified federal law enforcement. At the time, it said it was not aware that the files taken had been released on the dark web or otherwise made public.

The people-notification step took much longer than the technical response. Conduent's 2025 annual report says individual and regulatory notifications began in October 2025 and were expected to finish by early 2026. The California Attorney General's breach list shows nine separate Conduent filings, reported between October 8, 2025 and April 27, 2026. Conduent says it provides notices on behalf of its clients.

How many people, and why the numbers differ

The count has changed over time, and different documents give different totals.

The class action settlement agreement, filed with the SEC, says approximately 62 million people were affected. It splits them into two groups: about 40 million whose data was kept in a form not readily accessible to outsiders, and about 22 million whose data was in files described as readily accessible. PYMNTS reported in February 2026 that Wisconsin's consumer protection agency posted a breach notice saying more than 25 million people were affected nationwide.

These figures do not match, and I could not reconcile them from the documents above. Counts by state also vary. The Iowa notice, for example, covers 643 Iowa residents. The practical point is the same for every total: your own letter, not the headline number, tells you whether your information was in the files.

Who may be affected and how to find out

You may have received a letter or email from Conduent even though you have never heard of it. That is not a sign the message is fake. According to the settlement papers, Conduent received information for most class members through services it provides to a current or former health plan. A smaller number came through services for an employer or a government benefits program.

If a letter arrives, take these steps:

• Read who it says it is sent on behalf of. Notices are tied to a client of Conduent.
• Compare the sender and return address with the examples filed with state attorneys general. The sample notice filed in Vermont uses a Secure Processing Center in Suwanee, Georgia.
• Do not click links in an email or text you did not ask for. Look up the phone number or website from a source you already trust.
• If you think you were affected but did not get a letter, the settlement papers say the long-form notice will direct you to the settlement administrator to confirm whether you are a class member. The administrator is named as Epiq Class Action & Claims Solutions, subject to court approval. The official settlement website is [À REMPLIR]: the draft notice only shows a placeholder address, so use the website printed on your mailed notice.

Your state attorney general's website may also list the filing. The California list is searchable by company name.

What data was exposed

It depends on the person. In its Iowa filing, Conduent says the affected file may include an individual's name and Social Security number. Conduent did not say that every person's file held the same details, and the content of the letters differs by client. Your own notice is the authoritative list for your case.

The settlement agreement offers medical data monitoring to one of its two groups and credit monitoring to the other. Because most class members came to Conduent through a health plan, some files may relate to health coverage. I did not find a complete list of data types in the documents I opened, so read your letter to see which items it names.

A Social Security number is the item that matters most, because it is hard to replace and can be used to open credit in your name.

What to do now

None of these steps depends on knowing whether your data has already been misused.

Freeze your credit. The FTC explains that a credit freeze means nobody can open a new credit account in your name, including you, until you lift it. The FTC says it is free to place or lift and lasts until you lift it. You contact each of the three bureaus: Equifax, Experian, and TransUnion.

Or place a fraud alert. The FTC says an initial fraud alert is free, lasts one year, and can be renewed. You only contact one bureau, which must tell the other two. Conduent's sample letter describes an initial alert of ninety days. The FTC's page gives one year, so check the current rule with the bureau when you place it.

Use the monitoring offer in your letter. Conduent's sample notice filed in Vermont describes a membership with credit monitoring, identity restoration help, and dark web monitoring. It also says you must enroll by a deadline and give your activation code. Offers differ by client, and some deadlines have passed. If yours has, a freeze is still available.

Check your accounts and reports. Conduent's sample notice points you to AnnualCreditReport.com for your free credit reports. Look at your bank, card, and health insurance statements for charges or services you do not recognize. For insurance, review any explanation-of-benefits statements for care you did not receive.

Report identity theft if it happens. The FTC runs IdentityTheft.gov, where you can report identity theft and get a recovery plan.

Change passwords tied to your information. The incident described by Conduent is about files, not logins. Still, if you reuse passwords, this is a good time to stop.

Phishing after a breach

Breach news is useful to scammers. The FTC advises being wary of unexpected emails or texts that seem to come from a company you know, particularly ones that mention an account problem or an urgent payment. Its test is simple: do you have an account with the company or know the person who contacted you? If not, the message may be phishing, and the FTC suggests reporting and deleting it.

The FTC also says that legitimate companies will not email or text a link to update your payment information. If you did share a Social Security number, card number, or bank account number with a suspicious sender, the FTC points you to IdentityTheft.gov for recovery steps. You can forward phishing emails to reportphishing@apwg.org, forward texts to 7726 (SPAM), and report to the FTC at ReportFraud.ftc.gov.

Watch for fake "claim your settlement" messages in particular. Official settlement notices come from a court-approved process. Start from your mailed notice or the court docket, not from a message that lands unprompted.

The class settlement

A consolidated class action is pending in federal court. The case is In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, in the U.S. District Court for the District of New Jersey.

In an SEC filing, Conduent said that on October 16, 2026 it entered into a settlement agreement. It will fund $80 million into a non-reversionary settlement fund, which it describes as its total monetary obligation. The filing says the agreement remains subject to court approval and is not an admission of fault or liability, which Conduent denies.

The agreement itself, filed as an exhibit, describes what the proposed settlement would offer. This is a description of the draft terms, not a promise of any payment to you:

• One year of monitoring for class members, with no claim needed: credit monitoring for the first group, medical data monitoring for the second.
• Reimbursement for documented, unreimbursed losses, up to $3,500 per person, if the losses are tied to the incident and you can document them.
• A pro rata cash payment for the second group only, with the amount depending on what remains in the fund.

The agreement also says claim forms are due 75 days after notice begins, and that notice starts no later than 40 days after the court's preliminary approval. Opt-out and objection deadlines are 90 days after notice begins. I could not find a published settlement website or a confirmed approval date in the documents I opened, and the draft shows a placeholder web address. Deadlines may already have passed by the time you read this, or may not have started. Check your mailed or emailed notice and the court docket for the real dates before you act.

Check which breaches your email appears in

A Conduent letter tells you about one incident. Your email address may also appear in other known breaches. The free scan can show whether an email address appears in known breaches, using Have I Been Pwned and LeakCheck, with any passwords shown masked. It is not built to detect the Conduent incident specifically, and an empty result does not mean your information is safe.