HackingFinancial ServicesTechnologyFinanceSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Continental Casualty Company and its affiliates (CNA)

bd_972d61c63095353e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 13, 2025

Filed

Jan 28, 2026

To disclose

13 months

Affected

Not disclosed

Linked

3 filings

Confidence

67%

Full breach record for Continental Casualty Company and its affiliates (CNA) →2 incidents on file

Conduent Business Services, LLC, a third-party service provider for Continental Casualty Company, disclosed a cyber incident affecting data of health plan members. Unauthorized access occurred from Oct 21, 2024, to Jan 13, 2025. Affected data included names and government identifiers. Conduent engaged forensic experts, secured systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday13 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 84 days

discovery → filing · 13 months / 380 days

Oct 21, 2024

Begins

Jan 13, 2025

Discovered

Jan 28, 2026

Filed

vs. sector median

+46 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of CONDUENT BUSINESS SERVICES, LLC supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Texas State AGbd_1aea1d10f86079dd2026-02-02 · +5dCandidate
Illinois State AGbd_f1459712877956c72026-01-01 · +27dVerified

Name: Continental Casualty Company and its affiliates (CNA)
norm: continental casualty company and its affiliates cna
Domain: cna.com

Name: Continental Casualty Company and its affiliates (CNA)
norm: continental casualty company and its affiliates cna
Domain: cna.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Jan 13, 2025
Breach occurred: Oct 21, 2024 – Jan 13, 2025
Undetected for: 84 daysoccurrence → discovery
Materiality determined: Jan 28, 2026
Notification sent: Jan 28, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Third party: via Conduent Business Services, LLC
Initial access: supply_chain

During the incident: Secured networks
Initiated investigation with third-party forensic experts
Safely restored systems and operations
Notified law enforcement
Provided access to credit monitoring and identity restoration services through Epiq
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(380 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGJan 1 · first

Vermont State AG+27d · this page

Texas State AG+32d

Pattern: first filing Jan 1 (IL), last Feb 2 (TX) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-01-28-continental-casualty-company-and-its-affiliates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2026
Raw hash: 448ac1ef8ee741e326e7e07d2cf10b9ddd01127a8d0afaa161201e471946a46d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityContinental Casualty Company and its affiliates (CNA)

Victim entityContinental Casualty Company and its affiliates (CNA)

Incidentdiscovered Jan 13, 2025

Stated responseSecured networks

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov