iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Public figures for the Conduent breach are not a verified count of unique people. Conduent said its investigation was still assessing the precise impact of the stolen data; Texas later described about four million affected Texans, while Missouri cited media reports estimating 25 million or more affected. The available public statements do not reconcile those figures or establish a deduplicated nationwide total.
The frequently used “10 million to 25 million” framing should be read as a progression in reported estimates, not as two comparable, company-confirmed counts. The sources cited here do not establish the methodology or scope behind the 10 million figure.
How many people were affected by the Conduent breach?
The number depends on which statement is being described. Conduent’s April 2025 filing disclosed the incident and said the company was still analyzing the precise impact of data exfiltrated. In February 2026, the Texas Attorney General described approximately four million Texans as exposed. In May 2026, Missouri’s Department of Commerce and Insurance said some media reports estimated that 25 million or more people were affected.
| Figure | Source and date | What it establishes |
|---|---|---|
| 10 million | The basis is not established in the official statements summarized here. | It should not be treated as a confirmed count or assumed to use the same method as the later estimate. |
| Approximately four million Texans | Office of the Texas Attorney General, February 12, 2026 | A Texas-specific figure in an announcement of an ongoing investigation; it is not a nationwide total. |
| 25 million or more | Missouri Department of Commerce and Insurance, May 2026 | A figure the bulletin attributes to media estimates, not a verified total. |
These numbers cannot responsibly be added together or treated as successive counts of the same population. The available statements do not explain whether they count people, records, notices, or a combination; how different clients’ populations overlap; or whether duplicate individuals across states were removed. California’s Attorney General index lists Conduent breach filings and a sample notice, but its listing does not supply a reconciled national count.
#1 Best Overall
When did Conduent discover the breach?
Conduent’s incident disclosure, reproduced in its April 2025 SEC filing, gives the following timeline:
- October 21, 2024: The start of the unauthorized-access period identified by Conduent’s investigation.
- January 13, 2025: Conduent said it discovered the incident. The company also identified this as the end of the access period.
- April 2025: In its filing, Conduent described the incident and said it was continuing to analyze and document the precise detailed impact of the data exfiltrated.
- February 12, 2026: The Texas Attorney General announced civil investigative demands to Conduent and Blue Cross Blue Shield of Texas.
- May 2026: Missouri’s insurance department published a bulletin referring to media estimates of 25 million or more affected.
The dates describe different stages: the period of access identified by Conduent, the company’s discovery, and later public reporting and government inquiries. The later estimates do not, by themselves, show that Conduent had completed a nationwide count.
What information did Conduent expose?
The Texas Attorney General said the incident involved access to protected health information of Texas residents, including information concerning Texas Medicaid recipients. That is a statement about the Texas context. Conduent’s filing said the company was still analyzing the precise impact of the data exfiltrated; it does not provide, in the material summarized here, a complete list of data elements for every person potentially affected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For an individual, the most reliable description of the information at issue is the one in that person’s own notice. Different clients or affected groups may receive notices describing different data, so one recipient’s notice should not be assumed to apply to everyone.
What does the Texas investigation establish?
On February 12, 2026, Texas Attorney General Ken Paxton said his office had issued civil investigative demands to Conduent and Blue Cross Blue Shield of Texas. The office said it was seeking information about security measures, communications, and compliance with Texas law. The announcement described an ongoing investigation; it is not a finding that either entity is liable or that the investigation has reached a conclusion.
Paxton characterized the incident as “likely the largest breach in U.S. history.” That is his statement in the February 2026 release, not an independently established ranking. The release’s approximately four-million figure is Texas-specific and should not be substituted for a national count.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do with a Conduent breach notice?
Use the contact details and instructions in the notice sent to you. Check the notice’s stated data categories and any deadlines or enrollment requirements rather than relying on a general account of the incident.
- Confirm which information the notice says was involved and whether it identifies a relevant client, program, or date range.
- If the notice offers identity-theft or credit monitoring, review the exact enrollment deadline, service duration, coverage, renewal terms, and cancellation conditions.
- Missouri’s general bulletin says breach notices commonly include information about free identity-theft protection. That does not establish that every Conduent recipient received an offer or that all offers have the same terms.
- Keep the notice and any enrollment confirmation. Contact the sender using details in the notice if you are unsure whether it applies to you.
The Texas announcement establishes investigative demands, not a settlement, compensation process, or individual eligibility for a lawsuit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
