Conduent’s 83-day breach shows why DLP failed at the content layer

At a glance

What this is: This is Nightfall’s analysis of the Conduent breach, where attackers exfiltrated 8 terabytes of regulated data over 83 days without detection until systems failed.

Why it matters: It matters to IAM and data security practitioners because third-party access, session trust, and data movement controls now need to be governed as one attack surface, not separate problems.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

👉 Read Nightfall’s analysis of how Conduent lost 25 million records through delayed exfiltration detection

Context

Conduent’s breach is a data movement failure, not just a perimeter failure. The issue is not only that attackers got in, but that systems did not surface bulk exfiltration of regulated records while it was happening. For teams responsible for IAM, PAM, and data governance, that combination is especially dangerous because authorised access paths can become covert transfer channels once trust is assumed to be sufficient.

The article also points to a broader governance problem for third-party processors. When customer, patient, or benefits data flows through a vendor, the attack surface extends to every identity and every transfer path that vendor controls. That makes access control, content inspection, and response orchestration part of the same operational model, not separate security programs. Conduent’s starting position, in which detection occurred only after disruption, is unfortunately typical of legacy data protection architectures.

Key questions

Q: What breaks when content-aware DLP is not in place for regulated data flows?

A: Security teams lose visibility into whether authorised traffic is carrying sensitive records out of the environment. Attackers can use legitimate access paths, compress or rename files, and move data over normal channels while legacy controls stay silent. That is why content-aware controls are essential where PHI, PII, or customer records are processed at scale.

Q: Why do third-party processors create a larger governance problem than direct storage?

A: Because the organisation still owns the data risk even when a vendor runs the environment. Access boundaries, session control, and monitoring sit partly outside the customer’s direct control, yet the customer remains accountable for notification, impact, and oversight. Vendor access therefore needs the same governance discipline as internal privileged access.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions. If teams only see the breach after a leak site post, the control failed. Effective monitoring should surface unusual data movement before attackers can weaponise it.

Q: Who is accountable when a vendor breach exposes downstream client data?

A: Accountability is shared, but control ownership sits with the institution that granted access and the vendor that held it. Frameworks such as NIST Cybersecurity Framework 2.0 and identity governance programmes expect organisations to know their access boundaries and response responsibilities. If the access path was not governed, the incident becomes an accountability gap as well as a security one.

Technical breakdown

Why perimeter controls miss authorised-looking exfiltration

Perimeter tools decide whether traffic is allowed, but they often do not understand what is inside the traffic. Attackers can use legitimate credentials, normal protocols, and standard file transfer paths to move sensitive data without triggering classic network alerts. That is why content-aware inspection matters: it evaluates the data itself, not just the transport. In regulated environments, this gap is especially painful because exfiltration can proceed for weeks while every request still looks operationally valid. Practical implication: security teams need controls that inspect data content at the point of movement, not only at the network edge.

Practical implication: replace perimeter-only trust with content-layer controls that can block sensitive data leaving approved channels.

Why dwell time multiplies the damage in ransomware and vendor breaches

Dwell time is the period between initial access and detection. The longer attackers remain unseen, the more time they have to map systems, identify valuable data, and stage exfiltration in ways that blend into normal operations. In a third-party processing environment, the impact extends beyond one tenant because the vendor’s operational access can expose many customer relationships at once. This is why incident duration matters as much as initial compromise. Practical implication: measure how quickly you can detect and reconstruct data movement, not just how quickly you can isolate an endpoint.

Practical implication: set response objectives around detection latency and data lineage reconstruction, not just containment speed.

How AI egress expands the sensitive data perimeter

AI tools and agentic workflows create new paths for data leaving the organisation. A prompt, file upload, or copied snippet can become an egress event if the system does not classify and govern what is being shared. That makes AI usage a data security problem as well as an identity problem, because access decisions now include both human users and non-human agents operating at runtime. The control requirement is policy enforcement on the content being shared, regardless of the interface. Practical implication: treat AI prompts and file uploads as governed data flows, not informal user activity.

Practical implication: extend DLP and governance to AI prompts, uploads, and agentic workflows before those channels become shadow exfiltration paths.

Threat narrative

Attacker objective: The objective was to steal large volumes of regulated personal and healthcare data while maintaining enough stealth to extend dwell time and maximise downstream leverage.

1. Entry occurred through unauthorized access to Conduent’s systems, allowing the SafePay ransomware group to operate inside the environment without immediate detection.
2. Escalation took the form of sustained data staging and exfiltration over nearly three months, using access paths that did not trigger effective content-layer controls.
3. Impact was the theft of more than 8 terabytes of personal and healthcare data, followed by regulatory notifications, lawsuits, and long-tail exposure for millions of individuals.

NHI Mgmt Group analysis

Content-layer detection has become the missing control plane for regulated data. Conduent’s breach shows that perimeter trust is insufficient when attackers can move sensitive records through legitimate channels for weeks. Content-aware monitoring changes the question from "is the traffic allowed" to "is the data permitted to leave." For organisations handling PHI, PII, or delegated customer data, that distinction is the difference between auditability and blind spots.

Third-party processors now sit inside the effective identity and data governance perimeter. When a vendor processes data on behalf of others, identity controls, access boundaries, and data controls are inseparable. The breach illustrates a structural failure mode where customer organisations retain accountability while losing direct operational control over the environment that holds their data. Practitioners should treat vendor access paths, service identities, and transfer workflows as governed assets, not procurement details.

Detection latency is now a governance risk, not just an operations metric. Eighty-three days of undetected activity means control failure at the point where data left the environment, not at the moment access began. That is why frameworks such as NIST CSF and OWASP-NHI matter together: one covers resilience and monitoring, the other forces visibility into non-human and delegated access paths. The practical conclusion is simple. If you cannot observe data movement, you cannot claim effective governance.

Data lineage is becoming a security control, not a forensic afterthought. Conduent’s notification burden shows how hard it is to explain what was exposed after long dwell time and broad customer processing chains. The organisations that can reconstruct where data came from, where it went, and who touched it will make better containment and notification decisions. Teams should treat lineage as part of their security architecture, not a reporting convenience.

What this signals

Content-layer governance is becoming the operational centre of gravity for identity-aware data protection. As AI systems, processors, and human users all move sensitive information through the same platforms, teams need shared policy enforcement across access, content, and transfer paths. The gap is not whether data exists, but whether its movement is governed at runtime.

Detection latency should be treated like a control deficiency, not a metric report. If a team cannot see bulk movement of regulated records until business disruption occurs, then monitoring, lineage, and escalation logic are all misaligned. The practical next step is to define an incident threshold for data motion, then test whether the control stack can meet it.

Identity programmes now need to account for non-human and delegated transfer paths. Service accounts, integrations, and AI-assisted workflows can move regulated content without a human in the loop, which means access reviews alone are no longer enough. Teams should pair entitlement governance with content inspection and lineage evidence, using Top 10 NHI Issues and NIST CSF as the baseline reference points.

For practitioners

• Deploy content-aware exfiltration controls Inspect data at the point of transfer, not just at the perimeter, so bulk movement of PHI, PII, and credentials is blocked or quarantined in real time.
• Map third-party data flows to accountable identities Inventory which service accounts, vendor users, and integration paths can move regulated data, then tie each path to an owner and an approval boundary.
• Measure detection latency for high-value records Track how long it takes to notice staged exports, compressed archives, and large outbound transfers involving regulated datasets.
• Extend governance to AI egress channels Classify prompts, uploads, and file shares sent to external AI tools, then enforce policy on sensitive content before it leaves approved systems.
• Build lineage-ready incident workflows Record source, destination, and intermediary systems for sensitive data so investigators can reconstruct exposure chains quickly after an event.

Key takeaways

• Conduent’s breach shows that authorised-looking data movement can remain invisible for months when detection is focused on the perimeter instead of the content.
• The scale matters because more than 8 terabytes of regulated records were stolen before the intrusion was discovered, creating a long-tail exposure problem for millions of people.
• Content-aware DLP, lineage tracking, and third-party governance are now essential controls for organisations that process sensitive data on behalf of others.

Key terms

• Content-Aware Dlp: Content-aware DLP is a data protection control that inspects what a file contains before allowing it to move, print, or leave a device. It matters because endpoint policy should respond differently to ordinary files and protected information such as CUI, especially where transfer channels are diverse.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• Third-party processor: A third-party processor is an external organisation that handles data on behalf of another organisation. It can expand the effective attack surface because the customer retains accountability for the data while operational control sits partly with the processor.

What's in the full article

Nightfall's full research covers the operational detail this post intentionally leaves for the source:

• How Nightfall traces sensitive data across downloads, cloud sync, clipboard use, USB transfers, and AI prompts
• Why legacy DLP leaves 60 to 80% of sensitive data undiscovered across SaaS environments
• Examples of automated remediation options such as blocking transfers, redacting content, and revoking external sharing
• The report's data discovery and classification workflow for PHI, PII, financial records, and credentials

👉 Nightfall’s full report covers the detection gap, response workflow, and AI egress controls in more detail

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and identity practitioners connect access control with real-world operating models.