Conduent breach timeline, read from the 8-K and the notices

On 14 April 2025 Conduent filed a Form 8-K telling investors that an intruder had copied files from its systems. The filing gave the day the company found out, 13 January, and described the stolen data in one phrase: "a significant number of individuals' personal information associated with our clients' end-users". It gave no count, no start date and no list of what the files held. Those arrived over the next year and a half, in documents that are rarely read side by side: nine sample letters filed with California's Attorney General, an initial report in Oregon, six supplemental letters in Washington, a revised listing in Texas, the company's quarterly and annual reports, and one row in the federal health-breach portal that on 7 October 2026 reads 62,224,658.

This post lays that record on one timeline, shows what each document added and what none of them says, and draws out what it means for the people on either side of an outsourcing contract. Every fact comes from a public filing or a regulator's list retrieved on 7 October 2026. The dataset of 36 dated records, each with its source URL, ships with the article, along with a standard-library script that rebuilds every interval and count below and lists any public company's incident-related SEC filings.

The record on one timeline

Days count from 21 October 2024, the first day of access the notice letters give.

The company's first public word came 175 days after the intruder's first day inside, and the first letters to the people in the files came 177 days after that. The earliest count of people that the record dates is Oregon's, from 24 October 2025, more than six months after the 8-K, and the largest figure in the record is the one on the HHS portal today.

What the 8-K had to say, and what it said

Item 1.05 of Form 8-K asks a company that has determined an incident to be material to "describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant". The clock is in General Instruction B.1: the report "is to be filed within four business days after the registrant determines that it has experienced a material cybersecurity incident". The first instruction to the item adds that the determination "must be made without unreasonable delay after discovery of the incident."

Conduent's cover page gives 9 April 2025 as the date of the earliest event reported. EDGAR shows the filing accepted at 00:14 UTC on 15 April, with a filing date of 14 April. The 8-K never says in words when the company decided the incident was material. If the cover date is that decision, the report went in three business days later, inside the four-day window (no federal holiday fell in between, by OPM's 2025 schedule), and the decision itself came 86 days after discovery.

What the filing did say: the intruder reached "a limited portion of the Company's environment"; the files were "associated with a limited number of the Company's clients"; the company had restored its systems and "returned to normal operations within days, and in some cases, hours"; "Due to the complexity of the files" it had "engaged cybersecurity data mining experts", who confirmed the personal data; it had accrued "material non-recurring expenses in the first quarter related to the event based on potential notification requirements"; and, to its knowledge, the data "has not been released on the dark web or otherwise publicly." It also said the company "is continuing to further analyze and document the precise and detailed impact of the data exfiltrated." What it did not say: when access began, how many people, which kinds of data, or which clients.

The form has a mechanism for facts that come later. Its second instruction says that where the Item 1.05 information "is not determined or is unavailable at the time of the required filing", the company says so and "must file an amendment" within four business days of having it. Conduent's EDGAR record holds no 8-K/A for this incident. The later facts arrived in the text of its 10-Qs and 10-K, and in September 2026 in an Item 8.01 report. Whether a count of people is a "material aspect" of scope is a judgment the rule leaves to the company and to the SEC. The record shows only that none of the eight SEC documents on the incident that we read states one.

The letters: a start date, and the reason for the wait

California law, as its Attorney General's breach page puts it, requires that "a sample copy of a breach notice sent to more than 500 California residents must be provided to the California Attorney General", and the office publishes the copies. Conduent Business Services filed nine, between 8 October 2025 and 27 April 2026. The letter goes to people who may never have heard of the company, so it opens by explaining that Conduent "provides third-party printing/mailroom services, document processing services, payment integrity services, and other back-office support services", and that the reader's information "came into our possession due to the services that we provide to" a client whose name the template leaves as <<Client Name>>.

It also carries the fact that appears in no SEC filing: "an unauthorized third party had access to our environment from October 21, 2024, to January 13, 2025". That is 84 days inside before discovery. Oregon's list gives the same start date and 13 January 2025 as the date of discovery, and Washington's gives 21 October 2024 as the date of the breach.

The letter gives its own reason for arriving 268 days after discovery: "Given the nature and complexity of the data involved, Conduent has been working diligently with a dedicated review team, including internal and external experts, to conduct a detailed analysis of the affected files to identify the personal information contained therein." The notice comes "upon the recent conclusion of this time-intensive data analysis". A last line rules out the other usual explanation for a late notice: "Notice was not delayed as a result of law enforcement." By the letter's own account, the pace was set by working out what the files held, not by the investigation of the intrusion.

The count, in four lists

No SEC filing gives a number. The state and federal lists give several, filed at different times and for different scopes.

Oregon publishes the figure from each entity's first report, and says so: "Supplemental notices are processed internally, but updates to the affected numbers, etc. are not reflected in this public database." Its column holds whole-incident totals rather than Oregon residents (the same column lists Equifax at 143,000,000), and for Conduent's report of 24 October 2025 it reads 10,515,849.

Washington's list shows 87,975 residents for the same date. The PDF behind that row holds six supplemental letters from Conduent's counsel, each reporting people notified since the one before:

The Washington count ended at 9.08 times its first figure. The March letter came after Conduent "has done a full accounting of all prior notifications", seventeen months after the intrusion began. Every letter says the notices went out "on behalf of one or more covered entities and/or data owners".

Texas lists one Conduent row, titled "Conduent Business Services, LLC (revised submission)" and published on 20 May 2026, with 12,784,367 Texans affected. Texans alone outnumber the whole initial Oregon figure by 2,268,518.

The HHS breach portal lists Conduent Business Services as a business associate, with a report submitted on 8 October 2025 and 62,224,658 individuals affected. That is 5.92 times the initial Oregon figure. It is also the largest of the 765 cases on the portal's list of HIPAA breaches "reported within the last 24 months that are currently under investigation"; the next largest is 15,000,000, so Conduent's is 4.15 times it.

The displayed data types say what the files held. Washington lists name, Social Security number, full date of birth, health insurance policy or ID number, and medical information. Texas lists name, address, Social Security number, driver's license number, financial information, medical information, health insurance information and date of birth.

The money and the court

The 10-Q for the first quarter of 2025 shows $25 million of "direct response costs" for the incident, charged in that quarter. Conduent then reported paying it out: $9 million by 30 September 2025, $17 million by 31 December 2025, and the full $25 million by 31 March 2026. Above that amount, notification expense up to the coverage limit was "anticipated to be covered by the cyber insurance policy", and the 10-K added that the company "may experience costs beyond notification, but is not able to determine or predict whether the ultimate costs beyond notifications could exceed any applicable coverage limit." The filings do not say what the insurer paid, so the full cost of writing to the people counted above is not in the record.

The lawsuits followed the letters. The 10-K reports "several lawsuits" by people "who allegedly received a notification letter", most of them consolidated in the U.S. District Court for the District of New Jersey as In re: Conduent Business Services Data Breach Litigation. A consolidated complaint was filed on 18 March 2026 and an amended one on 12 June, and the case was stayed through 7 September "while the parties explore potential resolution." On 10 September 2026, under Item 8.01, Conduent reported an agreement in principle to settle, reached in August, which "has not yet been approved by the court"; it said it "does not expect the settlement to have a material impact". The 10-Q for the first quarter of 2026 also mentions "subpoenas, information requests, and investigations from certain governmental agencies", without naming them.

What a defender takes from the record

The record says nothing about how the intruder got in or how the files left, and this post does not guess. It does show where the time went, which is the useful part.

The intrusion ran 84 days before anyone noticed, and it was noticed when something broke. The 8-K ties discovery to an operational disruption. Scoping an intrusion that started three months before its discovery needs records from its first day, so the retention on authentication, file-access and outbound-transfer logs has to be longer than that on every system that holds other people's data. The exfiltration-stage controls in our kill-chain mapping apply whatever the intruder's motive.

The slow part was knowing what was in the files. Restoring systems took days. Working out whose data the stolen files held took about nine months, and the Washington letters show the count still growing in March and April 2026. A company that holds documents for many clients can say whose data was in the stolen files only as fast as its own inventory allows: which client each store belongs to, which record types it holds, and how long they are kept. That is a control built before an incident, never during one.

If you are the client, your customers may hear about it from your processor, months later. The letters were printed with a client-name field and sent by Conduent on its clients' behalf. A contract decides how quickly a processor must tell a client, how much it must tell, and who writes to the client's customers. In this record, the second of those took nine months to answer.

Read a vendor's 8-K as the first document, not the last. Note the cover date and the filing date; look for an 8-K/A; search the next 10-Q and 10-K for the incident's name; then look for counts where companies are required to give them, in state breach lists and, for health data, the HHS portal. Expect the count to move.

Run it yourself

The script reads the shipped CSV and prints the timeline, the intervals, the counts and the payments, with no network access. With --edgar and a company's Central Index Key it fetches that company's EDGAR submissions record once and lists its Item 1.05 and Item 8.01 reports along with its 10-Qs and 10-Ks, which is the first pass of the reading described above. The SEC asks automated clients to identify themselves, so the script refuses that mode without a --ua string giving a name and a contact address. The listing is this function:

def edgar_incident_filings(cik: str, since: str, ua: str, items=("1.05", "8.01")) -> list[dict]:
    """8-K and 8-K/A filings carrying any of `items`, plus every 10-Q and 10-K, filed on or after `since`."""
    url = "https://data.sec.gov/submissions/CIK%010d.json" % int(cik)
    req = urllib.request.Request(url, headers={"User-Agent": ua, "Accept-Encoding": "identity"})
    with urllib.request.urlopen(req, timeout=60) as resp:
        recent = json.load(resp)["filings"]["recent"]
    out = []
    for i, form in enumerate(recent["form"]):
        if recent["filingDate"][i] < since or form not in ("8-K", "8-K/A", "10-Q", "10-K"):
            continue
        if form in ("8-K", "8-K/A") and not set(recent["items"][i].split(",")) & set(items):
            continue
        acc = recent["accessionNumber"][i]
        out.append({"filed": recent["filingDate"][i], "accepted_utc": recent["acceptanceDateTime"][i],
                    "form": form, "items": recent["items"][i], "report_date": recent["reportDate"][i],
                    "url": f"https://www.sec.gov/Archives/edgar/data/{int(cik)}/{acc.replace('-', '')}/"
                           f"{recent['primaryDocument'][i]}"})
    return sorted(out, key=lambda r: r["accepted_utc"])

python code/conduent-breach-timeline-from-the-filings.py
python code/conduent-breach-timeline-from-the-filings.py --edgar 1677703 --since 2025-01-01 \
    --ua "Acme Security Team security@acme.test"

The offline run ends with these two blocks:

Intervals
  access began -> discovered:              84 days
  discovered -> 8-K cover date:            86 days
  8-K cover date -> 8-K filed:             5 calendar days, 3 business days
  discovered -> 8-K filed:                 91 days
  8-K filed -> first California notice:    177 days
  discovered -> first California notice:   268 days
  discovered -> last California notice:    469 days (9 filings)
  access began -> last California notice:  553 days
  discovered -> settlement 8-K:            605 days

Counts
  Oregon DOJ, initial report                  10,515,849
  Washington AG, first report                     87,975
  Washington AG, 6 supplemental letters          710,642
  Washington AG, cumulative                      798,617  9.08x the first report
  Texas AG, revised listing (Texans only)     12,784,367  +2,268,518 vs the Oregon report
  HHS OCR, individuals affected               62,224,658  5.92x the Oregon report
  HHS OCR, next-largest open case             15,000,000  Conduent's is 4.15x this
  Texas AG data, total field (not displayed)  62,486,662  +0.42% vs HHS

For Conduent's key, 1677703, the EDGAR mode returns eleven filings since 1 January 2025: the Item 1.05 report, three Item 8.01 reports (one about a share buyback, one about the board chair, one the settlement) and seven 10-Qs and 10-Ks. Item 8.01 carries many kinds of news, which is why the script prints a reminder to open each one.

What we could not check

• How the intruder got in, how the files left, which clients were involved and how many: none of the records we read says.
• Whether 62,224,658 is final. The HHS portal shows only the current figure, not its history, and Texas warns that "Details including number of affected Texans and whether notice was provided to them may change after a report is listed here."
• The data behind Texas's table carries one field the page does not display: a total of 62,486,662 individuals for the revised submission, within 0.42 percent of the HHS figure. Because Texas does not publish it, the HHS number is the one used above.
• That 9 April 2025 was the materiality decision. It is the cover page's date of the earliest event reported, which for an Item 1.05 report is the natural reading, but the filing does not say so.
• Maine's public breach database is offline ("The public-facing database will remain offline until then."), and Massachusetts's list refused our scripted requests, so neither state is in the record here.
• The settlement's terms, which no filing has stated yet.
• Have I Been Pwned, whose catalogue we summarised in one spreadsheet, has no Conduent entry among its 1,041 breaches as of 7 October 2026. That only means no data from this incident has been loaded there, which is consistent with the company's statement that it has seen no release.

The dataset

_README for conduent-breach-timeline-from-the-filings.csv, one row per dated record, 36 rows:

• date, date_precision: the date the record gives (a period end for payment figures), and whether it is a day or only a month
• kind: what the row records, one of access_start, discovery, 8k_cover_date, 8k_filed, usd_charged, usd_disbursed_cumulative, ocr_submitted, notice_filing_ca, count_initial_total, count_wa_initial, count_wa_added, count_tx_texans, count_tx_total_undisplayed, count_ocr, count_ocr_next_largest, litigation, settlement_agreed, settlement_disclosed, hibp_check
• record: the filing, letter or list the row comes from
• value: a count of people or an amount in US dollars, where the record gives one
• detail: what the record says, in short
• source_url, retrieved: where the record is, and the day it was read (2026-10-07)

The 8-K was the first public document in this record, and it could not have held the number that matters: on the day it was filed, by the company's own account, the files were still being analysed, and the count kept rising for another year. Reading a breach from its 8-K means reading the first page of a file that is still open.