FEDERALItem 1.05 · mandatoryHackingProfessional ServicesTechnologyProfessional ServicesBusiness ServicesCapture Stored DataData ExfiltratedCustomer Data InvolvedDownstream VictimsDelayed DiscoveryPIIIdentity (basic)LowContained

CONDUENT INCORPORATED

bd_6a28511dac1d715a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 13, 2025

Filed

Apr 14, 2025

To disclose

13 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

82%

Full breach record for CONDUENT INCORPORATED →8 incidents on file

On January 13, 2025, Conduent Incorporated experienced an operational disruption after a threat actor gained unauthorized access to a limited portion of its environment. The Company subsequently determined that the actor exfiltrated files associated with a limited number of clients, containing personal information of clients' end-users. Affected systems were restored within days; federal law enforcement was notified. Material non-recurring expenses were accrued in Q1 2025.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d13 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 13 weeks / 91 days

Jan 13, 2025

Begins

Jan 13, 2025

Discovered

Apr 9, 2025

Scope determined

Apr 14, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 4 about the same incident.View merged incident

A leak claim by safepay about this victim predates this filing by 95 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesafepaybd_da57970c8e98a6452025-01-09 · +95dVerified

Regulatory filings (2) · sorted by filing gap

Illinois State AGbd_1e232a462b71d0e32025-05-01 · +17dVerified
Presssafepaybd_b39f4b52b4d871fe2025-01-15 · +89dCandidate

Name: CONDUENT INCORPORATED
norm: conduent
SEC CIK: 0001677703
Domain: conduent.com

Name: CONDUENT INCORPORATED
norm: conduent
SEC CIK: 0001677703
Domain: conduent.com
Industry: Professional ServicesllmTechnologyllm
NAICS 561499 · All Other Business Support Services

Discovered: Jan 13, 2025
Breach occurred: Jan 13, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: Apr 9, 2025
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcement authorities

During the incident: Activated its cybersecurity response plan
Engaged external cybersecurity experts to contain, assess, and remediate the incident
Restored the affected systems and returned to normal operations within days, and in some cases, hours
Engaged cybersecurity data mining experts to evaluate the exfiltrated data
Notified federal law enforcement authorities of the incident
Informing clients as appropriate
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(91 days from discovery to filing)
Compliance flags: Leak >90dSEC 4-day OK · 5d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: Apr 9, 2025
→ Filed: Apr 14, 2025
5d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: Apr 9, 2025 → Filed: Apr 14, 2025	5d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

PressJan 15 · first

SEC 8-K+89d · this page

Illinois State AG+106d

Pattern: first filing Jan 15, last May 1 (IL) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1677703/000167770325000067/cndt-20250409.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 14, 2025
Raw hash: 266a1b726a023a12220daa265db385b503df261cf732cd7fb29dde6e9e64e803

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html27.9 KB

Download View at source

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityCONDUENT INCORPORATED

Victim entityCONDUENT INCORPORATED

Incidentdiscovered Jan 13, 2025

Stated responseActivated its cybersecurity response plan

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing