Volvo Group hit in massive Conduent data breach

A Conduent breach exposed data of nearly 17,000 Volvo Group North America employees as the total impact rises to 25 million people.

A data breach at business services provider Conduent has impacted at least 25 million people, far more than initially reported. Volvo Group North America confirmed that the security breach exposed data of nearly 17,000 of its employees, making it one of several major companies affected by the large-scale breach.

SecurityWeek reports that the breach now affects far more people than first thought: Texas sees 15 million impacted (up from 4 million) and over 10 million individuals in Oregon are also affected.

In November 2025, the company confirmed that January 2025 breach exposed the personal data of over 10M people, including names, addresses, DOBs, SSNs, and health and insurance info.

In April 2025, the business services provider revealed that personal information, including names and Social Security numbers, was stolen in a January cyberattack.

In January, the company announced that a cyberattack caused service disruptions after agencies in multiple US states reported outages. Wisconsin and Oklahoma noted impacts on payments and customer support.

Conduent disclosed that hackers accessed its network from October 21, 2024, to January 13, 2025, stealing personal data of users, including SSNs, DOBs, addresses, and health info. The company notified affected individuals and is offering free identity protection.

The Safepay ransomware group claimed the attack in February 2025.

Conduent, which provides printing, mailroom, document processing, payment integrity, and other back-office services, notified individuals about a data breach on behalf of Volvo Group. Volvo told the Maine Attorney General that 16991 employees were affected. The company said it only became aware of the incident in January 2026, months after the breach occurred.

“On behalf of our clients, Conduent Business Services, LLC (“Conduent”) provides third-party printing/mailroom services, document processing services, payment integrity services, and other back-office support services. We are writing to inform you about a recent incident experienced by Conduent that may have involved some of your personal information, which came into our possession due to the services that we provide to your current or former health plan.” reads the data breach notification sent to the impacted individuals and shared with the Maine Attorney General Office. “While we are unaware of any attempted or actual misuse of any information involved in this incident, we are providing you with information about the incident and steps you can take to protect yourself, should you feel it necessary.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)