Office of State Health Benefits
December 22, 2025
On December 2, 2025, the Department of Human Resource Management (DHRM) Office of Health Benefits was notified by Elevance (Anthem) of a cyber security incident discovered by Conduent, Inc., that involved data acquisition by an unknown threat actor. Conduent, Inc., a business associate to Elevance provides printing and mailing services, front-end digitization services, and payment integrity audits. Conduent discovered that the breach was traced to compromised VPN credentials resulting in the encryption of their internal systems.
The incident was limited to Conduent’s third-party environment and did not impact the Elevance Health network or systems. Conduent, Inc. promptly initiated an investigation in collaboration with the FBI and third-party analysts to determine the nature and scope of the incident. The incident has also been reported to law enforcement and the appropriate regulatory authorities.
Here is the information provided by Elevance at this time:
- Since discovery of the event, Conduent has identified impacted members.
- The investigation to date shows the information that may have been accessed includes first and last name, date of birth, Health insurance ID number, Patient ID number (assigned by provider), treatment cost, group policy number, and in some cases Social Security Number. However, not all individuals were impacted in the same way.
- No financial information was involved.
- Conduent collaborated with the FBI and worked with third-party analysts to expedite the investigation.
- The Conduent incident affected the vendor's third-party environment, Anthem’s business systems and networks were not impacted by this incident.
- Steps have been taken to implement additional safeguards relating to data privacy and security.
Conduent, Inc., will begin mailing notification letters to affected members from late December through January 2026. In some cases, individuals may receive more than one notice if they were impacted under multiple business functions within Elevance. DHRM will continue to monitor the situation and provide updates to state agencies and localities as necessary. All inquiries should be sent to Conduent.
For more information or questions regarding this incident, members should call Conduent, Inc at 1-877-332-1658, Monday through Friday, from 9:00 a.m. to 9:00 p.m. Eastern Standard Time. Additionally, members can write to Conduent, Inc., at the following address:
Attention: Data Incident
100 Campus Drive, Ste. 200
Florham Park, New Jersey 07932
Website: Notice of Data Incident
Please do not reply to this e-mail. You may send inquiries to the Office of Health Benefits mailbox at ohb@dhrm.virginia.gov.
|
