26-08 - Conduent Cybersecurity Breach, May 5, 2026

The Missouri Department of Commerce and Insurance issued Insurance Bulletin 26-08 on May 5, 2026, as a follow-up to Insurance Bulletin 26-05 (issued March 17, 2026), addressing the Conduent Business Services, LLC cybersecurity breach. Conduent provides document processing services to insurers, including receiving insurance claim forms, payment integrity services, and back-office support. An unauthorized third party accessed a portion of Conduent's network from October 21, 2024, to January 13, 2025, when the breach was discovered. The affected files contained names, addresses, Social Security numbers, and medical records, with some estimates placing the number of affected individuals at 25 million Americans or more. Since issuing Bulletin 26-05, the Department engaged directly with Conduent to assess the breach's impact on Missouri insurance consumers. The Department states that Conduent has been unwilling to provide the information necessary for the Department to evaluate that impact, characterizing the breach as reportedly one of the largest cybersecurity breaches in United States history. Because of Conduent's failure to cooperate, the Department directs all regulated insurers and entities that utilized Conduent or any of its affiliates, directly or indirectly, prior to or during the breach period to contact the Department's Market Conduct Section at marketconduct@insurance.mo.gov and provide information on the nature of services Conduent or its affiliates provided to them. The bulletin also reminds regulated entities of their existing duty to report cybersecurity breaches to the Director using the form at https://apps.dci.mo.gov/forms/CybersecurityEventNotification, and references Insurance Bulletins 26-01 and 23-04 and Section 407.1500 RSMo, the Missouri Insurance Data Security Act, as the governing framework for those reporting obligations.