Texas Attorney General Ken Paxton has issued Civil Investigative Demands (CIDs) to Blue Cross Blue Shield of Texas (BCBS) and Conduent Business Services LLC as part of an ongoing investigation into a massive data breach that exposed sensitive personal information of approximately four million Texans.
Paxton is investigating a breach of Conduent's system security that occured between October 21, 2024 and January 13, 2025. During that period, an unauthorized third party accessed protected health information belonging to Texas residents, including individuals enrolled in Texas Medicaid.
"The Conduent data breach was likely the largest breach in U.S. history. If any insurance giant cut corners or has information that could help us prevent breaches like this in the future, I will work to uncover it," Paxton vowed. "Texans deserve to know that their private health information is being handled responsibly and in full compliance with the law."
Blue Cross Blue Shielf of Texas is among multiple entities affected by the breach. As part of the investigation, the AG's office is demanding documents and information related to BCBS's compliance with Texas data protection and privacy laws.
The CIDs also seek detailed information from Conduent regarding its cybersecurity protocols, internal communications, incident response procedures, and compliance with state legal requirements governing the safeguarding of confidential health information.
Because the breach involved protected health information, including data tied to Medicaid recipients, the investigation raises significant questions about data security standards for contractors handling sensitive government healthcare information.
Paxton's office has indicated it intends to determine whether any entity failed to implement adequate safeguards or violated Texas law in connection with the breach.
The Investigation remains ongoing.
