Conduent’s 83-day breach shows why DLP failed at the content layer

At a glance

What this is: Nightfall argues that Conduent’s 83-day breach exposed a gap in perimeter-first DLP, where authorised-looking transfers can still carry sensitive data out at scale.

Why it matters: This matters because IAM, PAM and data security teams need controls that inspect content and lineage, not just access paths, especially when third-party processors handle regulated records.

By the numbers:

• For 83 days, attackers moved freely through Conduent's systems and exfiltrated 8 terabytes of healthcare records, Social Security numbers, and personal data belonging to tens of millions of Americans.
• Conduent's initial filings described "a limited number" of affected users, but Texas later reported 15.4 million affected residents.
• Current estimates exceed 25 million individuals across more than a dozen states impacted.
• Conduent has reported $25 million in breach response costs.

Context

Content-layer DLP is the control question this article raises. Perimeter checks can confirm that traffic is allowed, but they do not prove that the data inside the traffic is safe to move, especially when legitimate credentials and normal transfer paths are abused for exfiltration.

The Conduent case is also a third-party risk story, because the exposed records belonged to customers and beneficiaries whose original relationship was with other organisations. For identity and security programmes, that means vendor access, data lineage and sharing permissions have to be treated as part of the governance model, not as a downstream operational detail.

Key questions

Q: What breaks when DLP only watches files?

A: File-only DLP misses the moment when content is copied, pasted, or typed into a prompt. It may never see a document leaving the environment, only a text fragment entering a browser session. That leaves a blind spot for AI-driven work, where the most sensitive leakage often happens before any file is transferred.

Q: Why do authorised-looking transfers still create breach risk in third-party environments?

A: Because access approval does not equal data approval. A vendor can be authorised to handle a workflow while still being prohibited from moving certain records in certain ways, and that distinction is often where breaches happen. If the programme lacks lineage, classification and enforcement across vendor paths, the organisation cannot prove that data stayed within the intended boundary.

Q: How can security teams tell whether DLP is actually catching exfiltration?

A: Look for evidence that the control can identify sensitive data after it has been transformed, renamed, compressed or moved through common collaboration and AI channels. If detection only works on simple file transfers or known patterns, the programme is still blind to most real-world exfiltration. A working DLP stack should show policy decisions at the content layer, not only alerts at the network edge.

Q: When should organisations prioritise automated containment over manual escalation?

A: When the attacker can move from discovery to action faster than the team can convene a response. In cloud incidents involving leaked keys, phishing or adaptive malware, automated containment is often the only way to isolate workloads before damage spreads. Manual escalation still matters, but after the first containment move.

Technical breakdown

Why perimeter-first DLP misses authorised-looking exfiltration

Traditional DLP often inspects packets, ports or destinations before it inspects the content itself. That leaves a blind spot when attackers use valid accounts, standard sync tools, browser uploads or cloud-sharing workflows to move data. In those cases, the transfer can look operationally normal while the payload contains regulated records, which means network-centric controls may never trigger. Content-layer DLP reverses that priority by classifying the data first and then judging the action against policy. The technical difference matters because the attacker does not need to break transport controls if the organisation has not defined content-sensitive enforcement.

Practical implication: Inspect the payload and the action together, not just the network path.

Why regex-based detection struggles with modern data movement

Legacy DLP rules often rely on pattern matching for identifiers such as Social Security numbers or payment data. That works poorly once data is transformed, compressed, embedded in file formats or moved through collaboration tools and AI prompts. The result is noisy detection for some workflows and complete blindness for others, especially when the same data is repackaged repeatedly as it moves. Modern exfiltration detection needs classification, context and lineage so the control can recognise sensitive information even when the surface form changes.

Practical implication: Treat classification and lineage as core detection inputs, not optional enrichment.

How automated response changes the value of DLP

Alerting alone does not stop dwell time from becoming damage. If the organisation only learns about a policy violation after a human reviews a queue, the attacker may already have finished staging or exfiltrating the data. Automated response changes the control from observational to preventive by blocking transfers, revoking sharing, redacting content or terminating a session based on confidence thresholds. That is especially important for third-party processors, where the blast radius includes clients who did not directly choose the vendor’s internal controls.

Practical implication: Pair detection with pre-authorised containment actions for high-confidence events.

Threat narrative

Attacker objective: The objective was to steal large volumes of regulated personal and healthcare data while preserving access long enough to maximise exfiltration and leverage.

1. Entry occurred when the SafePay ransomware group gained unauthorized access to Conduent's systems and established a foothold that looked operationally legitimate.
2. Credentialed access and normal transfer paths then allowed the attackers to remain inside the environment for nearly three months without triggering a data-movement alarm.
3. During that dwell period, the attackers exfiltrated over 8 terabytes of regulated records, including Social Security numbers, medical histories and health insurance data.
4. Impact emerged only when systems stopped working, meaning the organisation discovered the intrusion after the exfiltration had already done lasting damage.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Perimeter-first DLP is no longer a defensible primary control for regulated data flows. The Conduent case shows that an authorised-looking transfer can still be a data breach when the content is sensitive and the destination is outside policy. For organisations that process PHI, PII or beneficiary records, the control problem is not whether traffic moves, but whether the data inside that traffic is allowed to move. Practitioners should treat content-layer enforcement as the baseline for modern data protection.

Third-party processors create an identity and governance problem as much as a data-loss problem. Once sensitive records sit with a vendor, access decisions, sharing permissions and downstream handling become part of the customer’s risk surface. That means data governance, IAM and vendor oversight have to align around the same lineage and entitlement picture. Content lineage gap: if you cannot trace where a record came from, where it was shared and who could move it, you cannot prove control over it. Practitioners should govern vendor data flows with the same rigour they apply to internal privileged access.

Dwell time turns content exfiltration into a compounding business risk. The longer an attacker can move data undetected, the more likely they are to stage, compress, rename and selectively extract the records that create the greatest downstream harm. In identity terms, that is often a control failure around standing access and invisible usage rather than a single authentication event. The lesson is that the security objective is not just detection, but interruption before bulk transfer completes. Practitioners should prioritise controls that can stop the session, not just report it.

Content-aware security is becoming inseparable from AI egress governance. The same blind spot that lets bulk records leave through ordinary channels also applies when staff paste regulated data into external AI tools. That makes DLP, AI policy and identity governance part of one control stack, not separate programmes. The broader market signal is that organisations now need one view of sensitive data across SaaS, collaboration and AI interfaces. Practitioners should align data controls with both human and machine-assisted workflows.

Blast-radius control is the new measure of DLP maturity. The question is no longer whether some data will move, but how much sensitive material can move before policy enforcement interrupts the session. That shifts programme design toward discovery, lineage, classification and automated containment rather than static rule libraries. The more regulated the data, the less tolerance there is for controls that only explain what happened after the fact. Practitioners should measure how quickly their stack can reduce exposure once abnormal movement begins.

What this signals

Content-layer enforcement is now the dividing line between observability and prevention. Organisations that still depend on perimeter controls will continue to miss authorised-looking movement through SaaS, collaboration and AI channels. The control objective has shifted to stopping sensitive data at the moment it is classified as out of policy, not after a transfer is complete.

Vendor data flows need the same governance discipline as privileged access. Third-party processors expand the attack surface because they also expand the number of places where sensitive records can be moved, copied or repackaged. That means security teams should align DLP, vendor access review and data lineage into one operating model rather than treating them as separate workstreams.

AI prompts are part of the egress surface now. Once employees can paste regulated data into external models, a traditional exfiltration model is incomplete. Security leaders should assume that data-loss controls, human access policy and AI usage governance are converging into a single programme requirement.

For practitioners

• Implement content-layer DLP for regulated records Classify PHI, PII and insurance data at the content level, then enforce policy on downloads, uploads, sync, clipboard and browser transfer paths.
• Map vendor data lineage end to end Track where sensitive records originate, which third parties can access them, and which downstream systems can move or copy them.
• Automate containment for high-confidence exfiltration Pre-authorise blocking, session termination, sharing revocation and redaction actions so response does not depend on manual review.
• Extend DLP policy to AI egress Treat external prompts, file uploads and AI-assisted copying as data egress events and apply the same classification rules used for SaaS and collaboration tools.
• Reduce standing access to sensitive repositories Review who can move bulk data out of repositories and remove persistent permissions that allow large transfers without additional control.

Key takeaways

• The Conduent case shows that a breach can run for months without perimeter controls noticing, even while regulated records are leaving the environment.
• The scale matters because bulk exfiltration of PHI, Social Security numbers and insurance data creates long-tail harm that cannot be remediated by password resets or simple revocation.
• Content-layer DLP, data lineage and automated containment are the control combination most likely to reduce dwell time and limit damage in third-party processing environments.

Key terms

• Execution-layer DLP: Execution-layer DLP is data loss prevention enforced at the point where a user interacts with an application, typically in the browser or local runtime. It is designed to stop sensitive data from leaving the organisation through copy, paste, upload, or typed input before the transfer occurs.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Content-aware Exfiltration Detection: Content-aware exfiltration detection identifies sensitive data leaving an environment by analysing the payload and surrounding context. It is designed to catch legitimate-looking transfers, transformed files and collaboration-tool movement that perimeter controls often miss.
• Third-party Data Processing Risk: Third-party data processing risk is the exposure that arises when vendors or processors handle data on behalf of another organisation. The risk includes access scope, downstream sharing, monitoring gaps and the difficulty of proving that sensitive records stayed within the intended boundary.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps security practitioners connect identity control to the data flows and privileged paths that shape real-world exposure.