Sedgwick Discloses Data Breach Following TridentLocker Ransomware Attack Sedgwick, a global claims management and risk services provider with operations in over 80 countries and annual revenue of $4–5 billion, confirmed a cybersecurity incident affecting its federal contractor subsidiary, Sedgwick Government Solutions. The breach occurred after the TridentLocker ransomware group claimed to have stolen 3.4GB of data on New Year’s Eve (December 31, 2025). Sedgwick Government Solutions handles claims and risk management for multiple U.S. federal agencies, including DHS, ICE, CBP, USCIS, DOL, and CISA. The company responded by activating incident response protocols with external cybersecurity experts and emphasized that the affected system—a segmented file transfer platform—was isolated from broader Sedgwick operations. There is no evidence of access to claims management servers or disruption to client services. Law enforcement has been notified, and impacted customers are being informed. Sedgwick stated that the incident did not affect its wider business systems. TridentLocker, a ransomware-as-a-service (RaaS) group that emerged in November 2025, employs double-extortion tactics, encrypting systems and threatening to leak stolen data if ransoms go unpaid. The group has targeted sectors including manufacturing, government, IT, and professional services, with victims primarily in North America and Europe, as well as China and the UK. Since its launch on November 11, 2025, the group has listed 12 confirmed victims on its Tor leak site.

The California Office of the Attorney General reported a data breach involving Sedgwick Claims Management Services, Inc. on January 12, 2021. The incident involved unauthorized access to records at data centers from July 31 to August 2, 2020, potentially affecting personal information including names, addresses, and Social Security numbers. The total number of individuals affected is unknown.