26-08 - Conduent Cybersecurity Breach, May 5, 2026

DEPARTMENT OF COMMERCE & INSURANCE P.O. Box 690 , Jefferson C ity. Mo, 65102-0690

INSURANCE BULLETIN 26-08

Conduent Cybersecurity Breach

Issued: May 5, 2026

The following Bulletin is issued by the Missouri Department of Commerce and Insurance ("Department'? to inform and educate the reader on the specified issue. It does not have the force and effect of law, is not an evaluation of any specific facts or circumstances, and is not binding on the Department. See section 374.015, RSMo.

To: All entities regulated by the Department I V1 ' Ii _ /'I

From: Angela L. Nelson, Director ~ 17( / I ~ Re: Addendum - Conduent Cybersecurity Breach

This bulletin is issued as a follow-up to Insurance Bulletin 26-05 to provide additional information to insurers and other entities regulated by the Missouri Department of Commerce and Insurance ("Department") regarding the Conduent cybersecurity breach. This bulletin also requests information from insurers and other entities regulated by the Department. Background

Conduent Business Services, LLC (“Conduent”) provides document processing services, including receiving insurance claim forms, payment integrity services, and other back-office support services to a variety of entities, including but not limited to insurers.

According to media reports, on January 13, 2025, Conduent discovered that an unauthorized third party had access to a portion of its network from October 21, 2024, to January 13, 2025. The affected files contained names, addresses, social security numbers, and medical records. Reports vary on the impact of the breach, with some estimating that potentially 25 million Americans or more were affected.

Since the issuance of Insurance Bulletin 26-05 on March 17, 2026, the Department has been in direct contact with Conduent to better understand the Conduent cybersecurity breach and its impact on Missouri insurance consumers, and to ensure that Missourians receive the identity protection assistance they deserve.

To date, Conduent has been unwilling to provide the Department with the information the Department needs to assess the impact of what is reportedly one of the largest cybersecurity breaches in United States history.

As a result of Conduent’s lack of cooperation, the Department is reminding insurers and other entities regulated by the Department to review Insurance Bulletin 26-05 and ensure they have taken the steps outlined therein.

Actions Needed:

Because of Conduent’s failure to provide information, the Department asks that any insurer or other entity regulated by the Department that utilized the services of Conduent or any of its affiliates prior to or during the time period of the cybersecurity breach, either directly or indirectly, contact the Department’s Market Conduct Section at marketconduct@insurance.mo.gov.

The Department would greatly appreciate insurers or other entities also providing information on the nature of services provided by Conduent or its affiliates. This information will guide the Department’s response to the cybersecurity breach.

2 The Department also reminds insurers and other regulated entities of their duties to report cybersecurity breaches to the Director using the form available on the Department’s website at https://apps.dci.mo.gov/forms/CybersecurityEventNotification, and as further outlined in the resources below:

Insurance Bulletin 26-01 Insurance Bulletin 23-04 Section 407.1500 RSMo The Insurance Data Security Act

Questions for the Department regarding an entity’s duties can be sent to cyberbreach@insurance.mo.gov.

Questions relating to the Conduent cybersecurity breach may be directed to Conduent. Conduent has a dedicated assistance line at 877-332-1658 (toll free), Monday-Friday, from 9:00 a.m. to 9:00 p.m. Eastern Time, and may also be contacted at Attn: Data Incident, 100 Campus Drive, Suite 200, Florham Park, New Jersey 07932.

Questions relating to the content of this bulletin may be directed to the Department’s Market Conduct Section at marketconduct@insurance.mo.gov

###

3