# Conduent Safepay Ransomware Breach — 25M+ PII/PHI Records Exfiltrated from Gov/Healthcare BPO Provider, Double-Extortion Data Theft via VPN Credential Abuse

> The Safepay ransomware group compromised Conduent, a major BPO provider servicing government agencies (toll systems, benefits), healthcare organizations, and enterprises including Volvo Group. The breach — originating from October 2024 with discovery in January 2025 — exposed personal data of 25+ million people including SSNs, dates of birth, medical information, and health insurance details. Safepay operates a double-extortion model using a LockBit-derived ransomware binary (locker.dll via regsvr32), with initial access via VPN credential compromise and RDP lateral movement.

- **Published:** 2026-03-01T08:46:08Z
- **Last reviewed:** 2026-03-01T08:46:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0161
- **ID:** TL-2026-0161
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** Safepay (Russia)
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Conduent is an American business process outsourcing (BPO) company spun off from Xerox in 2017, employing 56,000 people across 22 countries with $3.4 billion annual revenue. The company provides digital platforms and services for government agencies (toll systems, benefits administration, child support, Medicaid), healthcare organizations, insurers, and enterprises.
**Breach Timeline and Scope**: The threat actor gained initial access to Conduent's environment on October 21, 2024. The breach was discovered in January 2025 when a service outage revealed the compromise. Conduent disclosed the cybersecurity incident in April 2025 via SEC Form 8-K filing. Data breach notifications filed with US Attorney General offices confirm massive impact: 10.5 million affected in Oregon, 15.5 million in Texas (as reported by Volvo Group notification), 76K in Washington, with additional states yet to report. The total exceeds 25 million individuals.
**Data Exposed**: Names, Social Security Numbers, full dates of birth, health insurance policy/ID numbers, and medical information. This combination of PII and PHI creates extreme downstream risk for identity theft, medical fraud, synthetic identity creation, and targeted phishing campaigns.
**Safepay Ransomware Technical Analysis**: Safepay is a relatively new ransomware operation first observed in October 2024 by Huntress analysts, accumulating over 220 victims as of mid-2025. Analysis by Huntress reveals the ransomware binary (locker.dll) is derived from leaked LockBit source code, sharing extensive code similarities with LockBit samples from late 2022.
Key technical characteristics:
- **Execution**: Deployed via regsvr32.exe with command-line flags: -pass (password), -enc (encryption level), -uac (UAC bypass), -path (target path), -network (propagation), -selfdelete, -logging
- **Initial Access**: VPN gateway credential compromise (GlobalProtect VPN in Ingram Micro case) using compromised credentials and password spray attacks
- **Lateral Movement**: RDP with valid credentials. No new account creation or persistence mechanisms observed — relies on valid credentials throughout
- **Discovery**: ShareFinder.ps1 (Veil-PowerView) to enumerate accessible network shares
- **Defense Evasion**: Disabling Windows Defender Real-Time Protection and Automatic File Submission via GUI (SystemSettingsAdminFlows.exe), CMSTPLUA COM Object UAC bypass (DllHost.exe parent), SeDebugPrivilege token escalation, ThreadHideFromDebugger on worker threads
- **Data Collection**: WinRAR archiving with -v5g volume splitting, -r recursive, extensive file type exclusions, archiving from remote UNC paths
- **Exfiltration**: FileZilla FTP client for data transfer (installed, used, then uninstalled)
- **Encryption**: Multi-threaded encryption via worker thread pool (LockBit-derived), AES encryption with RSA key wrapping, .safepay extension appended
- **Anti-Analysis**: Cyrillic language killswitch (GetSystemDefaultUILanguage check), XOR-based string obfuscation (random single-byte key + index + first byte of kernel32.dll 'M'), token impersonation via DuplicateToken
- **Process/Service Termination**: Terminates SQL, Oracle, Exchange, Sophos, Veeam, backup services and Office/browser processes before encryption
- **Shadow Copy Deletion**: bcdedit /set recoveryenabled no + wmic shadowcopy delete
**Double-Extortion Model**: Safepay operates a Tor-based leak site listing victims with downloadable stolen data. They also maintain a TON (The Open Network/Telegram-based) site. The group's ransom note (readme_safepay.txt) claims data theft and threatens publication.
**Downstream Impact**: Conduent's client Volvo Group North America confirmed 17,000 customers/staff had personal details exposed. Multiple state government agencies processing benefits, child support, and Medicaid through Conduent were affected. The breach creates cascading risk across government services and healthcare systems that relied on Conduent for data processing.
**Prior Conduent Breach**: Conduent was previously hit by Maze ransomware in June 2020, making this their second major ransomware incident. The Safepay attack is significantly larger in scope.
**Safepay's Other Major Victim**: IT giant Ingram Micro suffered a SafePay attack in July 2025, with 3.5TB threatened for leak and 42,000 people confirmed affected. The attack pattern was identical — VPN credential compromise, RDP lateral movement, WinRAR archiving, FileZilla exfiltration.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1133 External Remote Services
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1548.002 Bypass User Account Control
- T1134.001 Token Impersonation/Theft
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1218.010 Regsvr32
- T1070.004 File Deletion
- T1480.001 Environmental Keying
- T1110.003 Password Spraying
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1560.001 Archive via Utility
- T1039 Data from Network Shared Drive
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [BleepingComputer — BPO giant Conduent confirms data breach impacts 10.5 million people](https://www.bleepingcomputer.com/news/security/bpo-giant-conduent-confirms-data-breach-impacts-105-million-people/)
- [BleepingComputer — Volvo Group North America customer data exposed in Conduent hack](https://www.bleepingcomputer.com/news/security/volvo-group-north-america-customer-data-exposed-in-conduent-hack/)
- [Huntress — It's Not Safe to Pay SafePay (Ransomware Technical Analysis)](https://www.huntress.com/blog/its-not-safe-to-pay-safepay)
- [BleepingComputer — Ingram Micro outage caused by SafePay ransomware attack](https://www.bleepingcomputer.com/news/security/ingram-micro-outage-caused-by-safepay-ransomware-attack/)
- [BleepingComputer — SafePay ransomware threatens to leak 3.5TB of Ingram Micro data](https://www.bleepingcomputer.com/news/security/safepay-ransomware-threatens-to-leak-35tb-of-ingram-micro-data/)
- [BleepingComputer — Govtech giant Conduent confirms client data stolen in January cyberattack](https://www.bleepingcomputer.com/news/security/govtech-giant-conduent-confirms-client-data-stolen-in-january-cyberattack/)
- [BleepingComputer — Conduent confirms cybersecurity incident behind recent outage](https://www.bleepingcomputer.com/news/security/conduent-confirms-cybersecurity-incident-behind-recent-outage/)
- [Maine Attorney General — Conduent Data Breach Notification](http://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/389e9d0d-8e23-497d-aaab-1c4c8a80707f.html)
- [NCC Group — Weak Passwords Led to SafePay Ransomware Yet Again](https://www.nccgroup.com/us/research-blog/weak-passwords-led-to-safepay-ransomware-yet-again/)
- [DCSO CyTec — SafePay: The New Kid on the Block](https://medium.com/@DCSO_CyTec/safepay-the-new-kid-on-the-block-4141188a626d)
- [BleepingComputer — Business services giant Conduent hit by Maze Ransomware (2020)](https://www.bleepingcomputer.com/news/security/business-services-giant-conduent-hit-by-maze-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0161