Dive Brief: 

• Conduent Inc. warned in an April 14 regulatory filing with the Securities and Exchange Commission that a “significant” number of people had their personal data stolen in a January cyberattack that affected a limited number of the company’s clients.
• The company, a major government payments technology vendor for social services and transit systems, was targeted in a Jan. 13 attack that disrupted certain operations. 
• The company warned it has incurred and accrued a material amount of nonrecurring expenses related to the breach. A spokesperson for the company did not have specific numbers yet, but a breach notification has already been posted by the California Attorney General’s office.

Dive Insight:

As previously reported, the January breach became public after Wisconsin officials confirmed delays in child support payments. The Florham Park, New Jersey-based firm provides technology used by various government agencies. 

Conduent confirmed in January that the attack was related to a cyber intrusion but did not elaborate on how the threat actor gained access or what specific techniques were used once the hackers breached the systems.

In a Feb. 19 letter that was posted Friday by the California AG’s office, Conduent said there was no additional threat activity following the January breach. Conduent worked with Palo Alto Networks’ Unit 42 on the breach investigation.  

Conduent confirmed in the SEC filing that the hackers gained access to a limited number of its clients and exfiltrated files that contained personal data for a significant number of end users that access its client’s databases. 

“The company continues its efforts to understand the full nature and scope of that affected data and will partner with its affected clients to provide appropriate notifications under the law,” a Conduent spokesperson told Cybersecurity Dive on Monday. 

Conduent is the vendor for the Wisconsin Child Support Trust Fund, and Wisconsin officials said the incident affected the ability to process child support payments. End users received payments through funds transfers or EBT cards.

The Wisconsin Department of Children and Families has been notified that no user data in that state breached, according to a spokesperson.

According to Conduent’s website, 37 states use the company’s Electronic Payment Card solutions, however it is not immediately known the total number of states affected by the breach. At the time of the attack, four states were said to be impacted.

State and local government data breaches have been a growing concern. A threat group was linked to the December attack on a Rhode Island social services database that was managed by Deloitte. More than 700,000 people were affected by that incident.