Conduent Settles Class Action Lawsuit for $80 Million Following Cyber Incident Affecting Millions
In a significant development for the digital services industry, Conduent, a well-known digital platform provider, has reached an agreement to pay $80 million to settle a class action lawsuit stemming from a major cybersecurity breach in 2024. This cyber incident compromised the personal and health data of approximately 62 million individuals, marking one of the largest breaches in recent history.
The financial settlement is designed to address material losses incurred by individual claimants whose personal data was exposed. It will also cover the costs related to credit monitoring and medical data monitoring services for affected individuals, alongside legal fees for the plaintiffs involved in the case. The details of the settlement were outlined in a filing submitted to the U.S. District Court for the District of New Jersey on October 16, 2026.
The settlement framework divides the affected individuals into two subclasses. The first subclass contains around 40 million individuals whose compromised data was stored in complex backup files, which were not easily accessible by third-party actors. The second subclass includes 22 million individuals whose stolen data was stored in files readily accessible by malicious entities.
Victims of the breach who can provide evidence of losses related to fraud or identity theft as a direct result of the incident are eligible for direct cash reimbursement. However, this reimbursement is capped at a maximum of $3,500 per claimant. If the court grants final approval of the settlement, Conduent will be absolved from civil liability concerning claims arising from the cyber incident.
As part of the settlement agreement, Conduent has pledged to enhance its data security measures, reflecting a growing recognition of the need for robust cybersecurity practices in today’s landscape. The company confirmed the settlement agreement in an 8-K filing submitted to the U.S. Securities and Exchange Commission (SEC), stating that the agreement does not imply any admission of fault or liability, which Conduent continues to deny. The filing also indicated that the company holds cyber insurance and does not anticipate that the settlement will materially impact its financial status, operational results, or cash flows.
Conduent operates a range of business services that include third-party printing and mailroom services, document processing, payment integrity services, and various back-office support services. Serving approximately 100 million U.S. residents across numerous government health programs, Conduent is integral to the operation of several major toll systems in the U.S. Moreover, it plays a crucial role in government payment disbursements for federally funded benefit and payment card programs.
Impact and Ranking of the Breach
The breach that prompted this lawsuit was allegedly conducted by the notorious SafePay ransomware group, which claimed responsibility for stealing an astonishing 8.5 terabytes of data from Conduent. The incident itself occurred in October 2024; however, the breach went undetected by Conduent for nearly three months.
In the aftermath of the breach, Conduent informed affected individuals that unauthorized actors had exfiltrated sensitive information, potentially including names, addresses, dates of birth, Social Security numbers, health insurance details, and medical records. According to the Health Insurance Portability and Accountability Act (HIPAA) Journal, this incident is now classified as the third largest healthcare data breach in history, as of October 2026, due to the extensive number of individuals whose protected health information was compromised.
For context, the title of the largest healthcare data breach remains with the 2024 ransomware attack on Change Healthcare, which affected more than 192 million people. Following closely behind is a 2015 incident involving Anthem, which compromised the data of 78.8 million individuals.
This unfolding series of events underscores the increasingly precarious position that organizations like Conduent occupy in an age where cyberattacks are not only common but can have devastating repercussions on both individual lives and larger systems. As cybersecurity continues to evolve as a critical concern, the implications of these breaches and their settlements will resonate throughout various industries, emphasizing the urgent need for robust data protection measures and responsible corporate practices.