26-05, Conduent Cybersecurity Breach, March 17, 2026

The Missouri Department of Insurance issued Bulletin 26-05 on March 17, 2026, addressing a cybersecurity breach at Conduent, a third-party services vendor. Conduent experienced unauthorized access to a portion of its network from October 21, 2024 to January 13, 2025. The affected files contained names, addresses, and social security numbers of members. Conduent has notified insurers, members, and law enforcement of the breach. Affected members are being offered 12 months of credit monitoring and identity restoration services at no charge, with an enrollment deadline of April 30, 2026. The Department directs insurers and other regulated entities that have utilized Conduent to determine whether their members were affected and to confirm that Conduent has notified those members. The Department further directs insurers to post breach-related information on their websites and to provide a point of contact for member inquiries. The Department reminds regulated entities of their duty to report cybersecurity breaches to the Director under the Missouri Insurance Data Security Act, sections 375.1400 to 375.1427 RSMo Supp. 2025, section 407.1500 RSMo, and Insurance Bulletins 23-04 and 26-01.