FEDERALUnknownTechnologyProfessional ServicesInformationPIIFinancialLowContained

CONDUENT INCORPORATED

bd_2adad4c0ebb2bc8c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 1, 2025

Filed

Feb 19, 2026

To disclose

14 months

Affected

Not disclosed

Confidence

50%

Full breach record for CONDUENT INCORPORATED →8 incidents on file

Conduent Incorporated (CNDT) disclosed a cybersecurity incident in its 2025 10-K filing, referred to as the January 2025 Cyber Event. The company processes substantial volumes of personal information and financial transactions for commercial and government customers. While specific technical details of the breach are not provided, Conduent maintains a liability on its balance sheet for expected remaining cash outlays related to the event. The company describes a robust cybersecurity risk management program aligned with NIST, PCI-DSS, and HIPAA standards, including active monitoring, third-party assessments, and an incident response plan.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d14 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 14 months / 414 days

Jan 1, 2025

Begins

Jan 1, 2025

Discovered

Feb 19, 2026

Filed

vs. sector median

+41 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

A leak claim by safepay about this victim predates this filing by 406 days.View originating leak claim

Name: CONDUENT INCORPORATED
norm: conduent
Domain: conduent.com

Name: CONDUENT INCORPORATED
norm: conduent
Domain: conduent.com
Industry: TechnologyllmProfessional Servicesllm

Discovered: Jan 1, 2025
Breach occurred: Jan 1, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIFinancial
Attack vector: Unknown

During the incident: Maintain a liability on the Consolidated Balance Sheet for our expected remaining cash outlay
Changes made: Devote significant resources to cybersecurity and cybersecurity risk management processes
Maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks
Integrate processes into our overall Enterprise Risk Management (ERM) program
Align corporate information technology environment with the Center for Internet Security (CIS) Critical Security Controls (CSC)
Certify/attest systems to applicable security standards, including NIST, PCI-DSS, HIPAA, ISO, and SOC 2
Safeguard information systems, monitor these systems, protect the confidentiality and integrity of our data
Train and raise awareness of cybersecurity threats among employees
Detect intrusions into our systems, and respond to cybersecurity incidents
Leverage a defense in depth philosophy
Perform simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts
Regularly monitors alerts and meets to discuss industry threats, trends, and remediation tactics
Prepare a cyber update that includes metrics and compliance performance
Receive cybersecurity alerts and threat intelligence from peers, government agencies, information sharing and analysis centers and cybersecurity associations
Conduct periodic external penetration tests and gap testing
Create and continually update a detailed incident response plan
Engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies
Assess key third-party cybersecurity controls through a cybersecurity questionnaire
Require the implementation of certain security controls in our contracts where applicable
Monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(414 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1677703/000167770326000024/cndt-20251231.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 19, 2026
Raw hash: 872c62d0d543741988623a5fbafb016c802356f8d0358e25a15f4f1bc84580b3

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.4 MB

Download View at source

Reporting entityCONDUENT INCORPORATED

Victim entityCONDUENT INCORPORATED

Incidentdiscovered Jan 1, 2025

Stated responseMaintain a liability on the Consolidated Balance Sheet for our expected remaining cash outlay

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing