Consumers Affected
4,000,000
Texas Attorney General Ken Paxton issued Civil Investigative Demands to Blue Cross Blue Shield of Texas and Conduent Business Services LLC as part of an investigation into a massive data breach at Conduent that exposed the protected health information of approximately four million Texans. The breach occurred between October 21, 2024 and January 13, 2025, affecting Texas Medicaid recipients and other residents. The AG's office is investigating the security failures and compliance with Texas law.
In-house legal teams should review all contracts with third-party service providers handling protected health information or other sensitive consumer data, ensuring they include robust data security safeguard requirements, clear breach notification timelines, and liability provisions for security failures. Contracts with vendors processing health data should specifically require compliance with applicable state and federal health privacy laws, regular security audits, and incident response protocols. Additionally, teams should verify that vendor agreements include provisions for prompt notification of any unauthorized access to data, as well as indemnification for breaches caused by vendor negligence.
Entity
Blue Cross Blue Shield of Texas and Conduent Business Services LLC
Also known as: Blue Cross Blue Shield and Conduent
Industry
Insurance"Blue Cross Blue Shield of Texas (“BCBS”) and Conduent Business Services LLC (“Conduent”)"
"exposed the sensitive personal data of approximately four million Texans"
"breach of Conduent’s system security that occurred between October 21, 2024 through January 13, 2025. During the breach, an unauthorized third-party accessed the protected health information of Texas residents, including Texas Medicaid recipients"
"Attorney General Ken Paxton"
"part of the investigation of the Conduent data breach"
"any insurance giant cut corners"
Texas Attorney General Ken Paxton sued Open AI Global, LLC and affiliated entities, alleging that ChatGPT was marketed as safe and reliable without disclosing risks of inaccurate or harmful outputs. The suit also alleges harms to minors and collection of their data without parental oversight; the release states no monetary penalty or specific remedy imposed.
Texas Attorney General Ken Paxton secured an Assurance of Voluntary Compliance with Lululemon USA Inc. after investigating potential PFAS and consumer representations about product safety. The agreement requires the company to maintain supply-chain chemical standards, verify vendor compliance through testing or certifications, and take corrective action for three years; no monetary penalty is stated.
$3.0M
Texas Attorney General Ken Paxton announced a settlement requiring Temu to protect Texans’ sensitive personal data from exposure to the Chinese Communist Party and to strengthen product-safety practices. Temu must pay Texas $3 million, comply with data-security requirements backed by a potential $8 million annual penalty, conduct annual independent product testing, and take specified action on products found to contain harmful substances.
$773.0M
Texas Attorney General Ken Paxton announced that a multistate coalition had secured an opioid settlement with Albertsons, which would require the grocery chain to pay more than $773 million nationally once final. Texas and its political subdivisions may receive up to $57.8 million for opioid abatement; the release does not identify privacy violations.
Texas Attorney General Ken Paxton sued Gerber Products Company and Nestlé USA, Inc., alleging that Gerber made deceptive safety and testing claims while its baby food contained dangerous levels of toxic heavy metals. The lawsuit asserts claims under the Texas Deceptive Trade Practices Act; the release does not report a settlement, monetary penalty, or court order.
$1.5M
The Texas Attorney General obtained a judgment holding Rubinsky Roofing LLC liable for 27 violations of the Texas Deceptive Trade Practices Act, including deceptive practices involving older consumers and payment for unnecessary or unfinished repairs. The judgment requires more than $1.5 million in civil penalties, allocates at least $500,000 to consumer restitution, and permanently bars the company and its owner from the practices at issue.