Sedgwick Confirms Cyber Breach at Government Contractor Subsidiary

Sedgwick has confirmed a cybersecurity breach impacting Sedgwick Government Solutions, a subsidiary that provides claims administration and risk management services to multiple U.S. federal agencies.

The company disclosed that the incident involved unauthorized access to a file transfer application used by the subsidiary. Upon detection, Sedgwick says it immediately activated its incident response protocols, engaged external cybersecurity experts, and notified law enforcement authorities.

What Was Compromised

According to Sedgwick’s statement:

The intrusion was limited to a specific file transfer system
There is no evidence of lateral movement into Sedgwick’s broader corporate network
Core claims processing platforms and operational systems were not impacted
Business operations continue without disruption

While the company has characterized the breach as isolated, it has acknowledged that data may have been accessed or exfiltrated during the incident.

Ransomware Group Claims Data Theft

A ransomware operation known as TridentLocker has publicly claimed responsibility for the breach. The group alleges it exfiltrated approximately 3.4 GB of data, which it has begun publishing on its leak site.

Sedgwick has not independently confirmed the authenticity of the leaked data. However, the timing of the claim aligns with the company’s disclosure, and TridentLocker has been linked to multiple confirmed extortion-driven intrusions since late 2025.

Sedgwick Government Solutions works with a range of high-value U.S. government entities, including agencies tied to homeland security, immigration services, and federal workforce administration.

Even when attackers gain access to a “non-core” system, the exposure can be meaningful:

File transfer platforms often handle structured reports, claims data, and agency communications
Stolen documents can enable secondary attacks, such as targeted phishing or social engineering
Government contractors are increasingly leveraged as indirect entry points into regulated ecosystems

This incident reinforces a growing reality in cyber risk: supply-chain adjacencies are now prime attack surfaces.

Pattern in Modern Breaches

The Sedgwick incident reflects a recurring trend seen across large enterprises and government contractors:

A peripheral system is compromised rather than a central platform
Attackers prioritize data theft over service disruption
Public disclosure occurs before the full scope of data exposure is known
Ransomware groups attempt to apply pressure through controlled leaks

While segmentation helped limit operational impact here, containment does not automatically equate to low risk, especially when sensitive government-linked data is involved.

Sedgwick Confirms Cyber Breach at Government Contractor Subsidiary

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

What Was Compromised

Ransomware Group Claims Data Theft

Pattern in Modern Breaches

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations