Automotive Giant Volvo Employee Information Exposed via Third-Party Conduent Data Breach

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

Volvo Group North America has exposed the personal information of nearly 17,000 employees due to a significant Conduent data breach. According to a filing with the Maine Attorney General, Volvo listed late January 2026 as the date when it discovered that its employee data was compromised.

Conduent is a major business services provider that handles HR and benefits administration for the automaker. 

Volvo Employee Data Exposed

The breach notification reveals that the attackers accessed and exfiltrated 16,991 employee health plan files from Volvo. While the full scope of exposed data varies by individual, compromised information includes employee names and potentially other elements, such as:

• date of birth, 
• postal address information, 
• Social Security numbers, 
• medical service information (treatment and diagnosis codes, provider names, dates of service and claim amounts), 
• group number 
• subscriber number.

Cybercriminals maintained access to Conduent's systems for a prolonged period, from October 21, 2024, to January 13, 2025. The timeline highlights a significant delay in discovery and notification.

Although Conduent has stated there is no evidence of data misuse, the SafePay ransomware group has claimed responsibility for the attack, alleging it stole 8.5TB of data.

Ransomware Threats

The data breach affecting Volvo employees is part of a much larger incident, with updated victim totals potentially reaching tens of millions, given Conduent's role in government and corporate services, as reports indicate that 25 million Americans were affected.

The SafePay claim shows how ransomware actors are targeting the supply chain to maximize impact. Reports this month revealed that 1.4 million Betterment email addresses were exposed following a third-party social engineering.

In 2025, Safepay targeted the U.S. defense contractor Hardwick Tactical and IT leader Ingram Micro, emerging as the most prolific threat actor of May 2025.

Related

Airman Pleads Guilty to Receiving Child Pornography at Joint Base, Philadelphia Man Sentenced to 15 Years in Similar Case

North Korean Operatives Impersonate Real Professionals on LinkedIn, the Security Alliance Warns

AI-Generated Malware Exploits React2Shell Vulnerability as LLM-Assisted Cyberattacks Target Cloud Infrastructure

Senegal Confirms National ID Agency Breach After Ransomware Attack, Threat Actors Claim Stealing 139 GB of Data

Ivanti Zero-Day Vulnerabilities Exploited in Global Cyberattacks, Dutch Government Breached, Possibly European Commission

Stalkerware Data Breach: Hacktivist Leaks Over 530,000 Customer Records

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Subscribe for Free

Please enter a valid email address.

Most Popular

Airman Pleads Guilty to Receiving Child Pornography at Joint Base, Philadelphia Man Sentenced to 15 Years in Similar Case

North Korean Operatives Impersonate Real Professionals on LinkedIn, the Security Alliance Warns

Local Pricing, Global Access: ExpressVPN Expands Currency Options

AI-Generated Malware Exploits React2Shell Vulnerability as LLM-Assisted Cyberattacks Target Cloud Infrastructure

Senegal Confirms National ID Agency Breach After Ransomware Attack, Threat Actors Claim Stealing 139 GB of Data

Ivanti Zero-Day Vulnerabilities Exploited in Global Cyberattacks, Dutch Government Breached, Possibly European Commission

Airman Pleads Guilty to Receiving Child Pornography at Joint Base, Philadelphia Man Sentenced to 15 Years in Similar Case

North Korean Operatives Impersonate Real Professionals on LinkedIn, the Security Alliance Warns

Local Pricing, Global Access: ExpressVPN Expands Currency Options

AI-Generated Malware Exploits React2Shell Vulnerability as LLM-Assisted Cyberattacks Target Cloud Infrastructure

Senegal Confirms National ID Agency Breach After Ransomware Attack, Threat Actors Claim Stealing 139 GB of Data

Ivanti Zero-Day Vulnerabilities Exploited in Global Cyberattacks, Dutch Government Breached, Possibly European Commission