Item 1.05. Material Cybersecurity Incidents
On January 13, 2025, Conduent Incorporated (the "Company") experienced an operational disruption and learned that a 'threat actor' gained unauthorized access to a limited portion of the Company's environment. Upon detection, the Company activated its cybersecurity response plan with the help of external cybersecurity experts to contain, assess, and remediate the incident. The Company restored the affected systems and returned to normal operations within days, and in some cases, hours. The disruption did not have a material impact to the Company's operations.
As part of its ongoing investigation, the Company determined that the threat actor exfiltrated a set of files associated with a limited number of the Company's clients. Due to the complexity of the files, the Company engaged cybersecurity data mining experts to evaluate the exfiltrated data and was recently informed of its nature, scope and validity, confirming that the data sets contained a significant number of individuals' personal information associated with our clients' end-users. The Company is continuing to further analyze and document the precise and detailed impact of the data exfiltrated, and clients are being informed as appropriate in order to determine next steps as required by federal and state law. To the Company's knowledge, the exfiltrated data has not been released on the dark web or otherwise publicly.
While the Company did not experience material impacts to its operating environment or costs from the event itself, the Company has incurred and accrued material non-recurring expenses in the first quarter related to the event based on potential notification requirements. The Company maintains a cyber insurance policy and has also notified federal law enforcement authorities of the incident.
Forward-Looking Statements
This Current Report on Form 8-K ("Report") and any exhibits to this Report may contain "forward-looking statements" as defined in the Private Securities Litigation Reform Act of 1995, as amended. The words "anticipate," "believe," "estimate," "expect," "plan," "intend," "will," "aim," "should," "could," "forecast," "target," "may," "continue to," "endeavor," "if," "growing," "projected," "potential," "likely," "see," "ahead," "further," "going forward," "current," and similar expressions (including the negative and plural forms of such words and phrases), as they relate to the Company, are intended to identify forward-looking statements, but the absence of these words does not mean that a statement is not forward-looking. These statements reflect the Company's current views with respect to future events and are subject to certain risks, uncertainties and assumptions, many of which are outside of the Company's control. Should one or more of these risks or uncertainties materialize, or should underlying assumptions prove incorrect, actual results may vary materially from those expressed or implied in this Report, any exhibits to this Report and other public statements the Company makes.
Important factors and uncertainties that could cause the Company's actual results to differ materially from those in any forward-looking statements include, but are not limited to: those regarding actions being taken and that will be taken in response to the incident referenced in this Report, including the Company's investigation of such incident and mitigation and remediation efforts, the nature and extent of such incident, the potential disruption to our business or operations from such incident, the potential impact on the Company's reputation, and the Company's assessments of the likely financial and operational impacts of the incident. Responding to and assessing these types of incidents is inherently challenging and these forward-looking statements are subject to a number of risks, uncertainties, estimates, and assumptions that may cause actual results to differ materially from current expectations, many of which are out of the Company's control. As a result, the financial and operational impact from the incident may be more severe than currently anticipated. Risks and uncertainties also include the risk factors detailed in the Company's filings with the Securities and Exchange Commission, including its Form 10-K and Form 10-Q filings. Any forward-looking statements made by the Company in this Report speak only as of the date on which they are made. The Company is under no obligation to, and expressly disclaim any obligation to, update or alter its forward-looking statements, whether because of new information, subsequent events or otherwise, except as required by law.