Topic starter
20/08/2026 5:58 pm
TL;DR: Conduent’s breach went undetected for 83 days while attackers exfiltrated more than 8 terabytes of sensitive records, showing how perimeter-first controls can miss authorised-looking data movement, according to Nightfall. The case reinforces that content-layer visibility, lineage tracking, and automated response are now core requirements for organisations handling regulated data and third-party processing.
Editorial analysis by NHI Mgmt Group, based on content published by Nightfall: “How Conduent Lost 25 Million Records in 83 Days: The DLP Failure Everyone Missed”.
By the numbers:
- For 83 days, attackers moved freely through Conduent's systems and exfiltrated 8 terabytes of healthcare records, Social Security numbers, and personal data belonging to tens of millions of Americans.
- Conduent's initial filings described "a limited number" of affected users, but Texas later reported 15.4 million affected residents.
- Conduent has reported $25 million in breach response costs.
Key questions
Q: What breaks when DLP only watches files?
A: File-only DLP misses the moment when content is copied, pasted, or typed into a prompt.
Q: Why do authorised-looking transfers still create breach risk in third-party environments?
A: Because access approval does not equal data approval.
Q: How can security teams tell whether DLP is actually catching exfiltration?
A: Look for evidence that the control can identify sensitive data after it has been transformed, renamed, compressed or moved through common collaboration and AI channels.
Practitioner guidance
- Implement content-layer DLP for regulated records Classify PHI, PII and insurance data at the content level, then enforce policy on downloads, uploads, sync, clipboard and browser transfer paths.
- Map vendor data lineage end to end Track where sensitive records originate, which third parties can access them, and which downstream systems can move or copy them.
- Automate containment for high-confidence exfiltration Pre-authorise blocking, session termination, sharing revocation and redaction actions so response does not depend on manual review.
Bottom line: The Conduent case shows that a breach can run for months without perimeter controls noticing, even while regulated records are leaving the environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:37 pm
Perimeter-first DLP is no longer a defensible primary control for regulated data flows. The Conduent case shows that an authorised-looking transfer can still be a data breach when the content is sensitive and the destination is outside policy. For organisations that process PHI, PII or beneficiary records, the control problem is not whether traffic moves, but whether the data inside that traffic is allowed to move. Practitioners should treat content-layer enforcement as the baseline for modern data protection.
A question worth separating out:
Q: When should organisations prioritise automated containment over manual escalation?
A: When the attacker can move from discovery to action faster than the team can convene a response. In cloud incidents involving leaked keys, phishing or adaptive malware, automated containment is often the only way to isolate workloads before damage spreads. Manual escalation still matters, but after the first containment move.
👉 Read our full editorial: Conduent’s 83-day breach shows why DLP failed at the content layer