Texas Attorney General Ken Paxton issued Civil Investigative Demands to Blue Cross Blue Shield of Texas and Conduent Business Services LLC as part of an investigation into a data breach that exposed the protected health information of approximately four million Texans. The breach, which occurred between October 21, 2024 and January 13, 2025, is believed to be the largest in U.S. history. The investigation focuses on Conduent's security measures and BCBS's compliance with state data protection laws.
In-house legal teams should immediately review all vendor, customer, and data processing agreements where Conduent Business Services LLC or similar service providers handle protected health information or sensitive personal data. Focus on clauses governing data security obligations, breach notification timelines and procedures, compliance with state-specific data protection laws (particularly Texas), data processing addendums, and indemnification/liability provisions. Given the investigation into potential negligence and the scale of the breach, contracts may require amendments to mandate stricter security safeguards (e.g., encryption, access controls), explicit adherence to Texas data protection statutes, clearer breach response protocols, and enhanced audit rights to ensure ongoing compliance and allocate risk appropriately.
Entity
Conduent Business Services LLC
Also known as: Conduent
Industry
TechnologyConduent Business Services LLC (Business Associate, NJ) reported a HIPAA breach affecting 42,616 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
$3.0M
Texas Attorney General Ken Paxton announced a settlement requiring Temu to protect Texans’ sensitive personal data from exposure to the Chinese Communist Party and to strengthen product-safety practices. Temu must pay Texas $3 million, comply with data-security requirements backed by a potential $8 million annual penalty, conduct annual independent product testing, and take specified action on products found to contain harmful substances.
$773.0M
Texas Attorney General Ken Paxton announced that a multistate coalition had secured an opioid settlement with Albertsons, which would require the grocery chain to pay more than $773 million nationally once final. Texas and its political subdivisions may receive up to $57.8 million for opioid abatement; the release does not identify privacy violations.
Texas Attorney General Ken Paxton sued Gerber Products Company and Nestlé USA, Inc., alleging that Gerber made deceptive safety and testing claims while its baby food contained dangerous levels of toxic heavy metals. The lawsuit asserts claims under the Texas Deceptive Trade Practices Act; the release does not report a settlement, monetary penalty, or court order.
$1.5M
The Texas Attorney General obtained a judgment holding Rubinsky Roofing LLC liable for 27 violations of the Texas Deceptive Trade Practices Act, including deceptive practices involving older consumers and payment for unnecessary or unfinished repairs. The judgment requires more than $1.5 million in civil penalties, allocates at least $500,000 to consumer restitution, and permanently bars the company and its owner from the practices at issue.
The Texas Attorney General opened an investigation into UnitedHealth Group over allegations that its insurance-benefit administration and patient-care decisions denied Texans medically necessary healthcare. The AG issued Civil Investigative Demands to collect evidence; the release announces no penalty or remedy.