Skip to content
DysruptionHub
Sign in Subscribe

Conduent cyberattack disrupts child-support payments

Summary

Conduent logo

Conduent’s January 2025 cyberattack disrupted government payment processing and exposed client data. Wisconsin resumed child-support processing Jan. 19; later litigation described a much larger data theft and a proposed settlement awaiting court review.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Low
Attribution:
Low

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Backlog created

    The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Conduent discovered unauthorized access and an operational disruption on Jan. 13, 2025. Its later notification letter places the intruder’s access between Oct. 21, 2024, and Jan. 13, 2025. The access period therefore began before the January service interruption.

A company spokesperson acknowledged the compromise on Jan. 21, describing several days of disruption during recovery. An April SEC filing subsequently confirmed that client files containing personal information had been stolen.

Operational significance

Wisconsin’s child-support program provides a documented example of the downstream effects. Its Jan. 17 notice said Conduent was rebuilding a server and that four states were affected. Scheduled support payments through electronic transfers and benefit cards were delayed, although payments from payors continued arriving.

On Jan. 19, Wisconsin said the outage was fixed and processing had resumed, with additional staff handling delayed payments. That technical restoration does not establish when every payment backlog cleared. The company later reported a return to normal operations within days, or hours for some systems. Its assessment that the outage did not materially affect company operations does not negate the documented effects on beneficiaries.

Confidence and uncertainty

Confidence in the compromise, disruption and data theft is high because of company disclosures and contemporaneous agency statements. A SafePay tracker lead identifies conduent.com, but the reviewed company filings do not confirm that group or file encryption. The description of a third-party compromise does not, by itself, establish a compromised supplier as the entry route.

The October 2026 settlement agreement describes approximately 62 million people whose information was in exfiltrated files. It distinguishes about 40 million whose data was stored in a complex form from about 22 million whose data was more readily accessible. Those distinctions do not establish that every record was read or misused.

Conduent’s Oct. 16 filing describes a proposed $80 million settlement covering benefits, monitoring, legal fees and administration, without admitting liability. In an Oct. 22 order, the court requested further evidence by Nov. 5 before assessing approval. The proposal is not a final judgment or proof of completed payments.

Analytic gaps

The entry technique, independently confirmed actor, any encryption, ransom outcome and exact date when all downstream delays ended remain unresolved. Wisconsin is directly identified; its reference to four states does not identify all of them. A child-support benefit-card disruption is not sufficient evidence of a SNAP outage. Operational status is presumed resolved, with no exact final date assigned; the later data review and litigation do not establish continued service downtime.

Threat actor and claim

SafePay

Listed as: conduent.comSource: ransomware.liveDiscovered:

Claim details

The ransomware.live lead lists conduent.com as an alleged SafePay victim, with tracker discovery on Feb.20,2025 (20:11:10.317038UTC in the returned lead). The tracker supplies no attack date or independently verified attribution. Conduent separately confirmed unauthorized access and theft of client files, but the reviewed company disclosures do not confirm SafePay, file encryption or a ransom payment. Treat the group association as an allegation; the tracker observation is not the original actor-post publication time, the October2024 intrusion start or the January2025 service disruption. Preserve the existing claim rather than creating a duplicate, and keep it distinct from the separate2020 Maze incident and July2025 Georgia event.

Organizations involved

Impacted location

  • Florham Park, New Jersey

    Medium Confidence

    Florham Park is the documented headquarters municipality of the affected company at100CampusDriveSuite200. This preserves the incident’s physical corporate anchor. Available sources describe an enterprise-system compromise and downstream service effects; they do not identify the headquarters as the intrusion origin or establish an outage throughout Florham Park.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.