Healthcare,
Industry Specific,
Litigation
Data Theft From Back Office Services Firm Affected 62.2 Million
In a significant turn of events, plaintiffs representing approximately 62.2 million individuals who were affected by a major cybersecurity breach have reached a preliminary settlement of $80 million in a class-action lawsuit against Conduent, a back-office support services firm. This lawsuit stems from a hack that occurred in 2024, a breach that has since been labeled as one of the most impactful data security incidents in recent history.
The proposed settlement, which was filed on a Friday in a federal court in New Jersey, includes provisions for financial compensation to the affected individuals. Additionally, it offers credit and medical data monitoring services, along with a commitment from Conduent to bolster its cybersecurity measures to prevent similar incidents in the future.
The circumstances surrounding the breach have spurred allegations against Conduent for failing to adequately protect sensitive personal information. While the firm has reached this settlement, it maintains that it denies any wrongdoing or liability related to the incident.
Conduent, created as a spin-off from Xerox in 2017, had publicly disclosed the breach in April 2025 in a filing to the U.S. Securities and Exchange Commission (SEC). In that report, the company noted that it had been victimized by a cyberattack that resulted in the exposure of extremely sensitive data belonging to millions of individuals, accentuating the gravity of the incident as the largest health data breach reported in 2025.
The firm operates a myriad of back-office support services for various businesses and government entities across 22 countries and reported revenue figures of approximately $3 billion in the year 2025. The breach itself involved a significant data extraction, with plaintiffs alleging that the cybercriminal gang known as SafePay managed to exfiltrate about 8.5 terabytes of data from Conduent’s IT infrastructure. This stolen information encompassed sensitive details including personal names, addresses, dates of birth, Social Security numbers, and health insurance specifics, alongside critical medical information.
SafePay has been identified as a relatively obscure ransomware group but has been implicated in several cyberattacks within the healthcare domain, including a notable incident that targeted a pathology practice in North Carolina earlier in 2025. This connection has raised concerns regarding the security of sensitive information in the healthcare sector, a sector that has often found itself vulnerable to cyber exploits.
The financial implications of the proposed settlement are extensive, encompassing cash benefits for those impacted, expenses associated with administering the settlement, and court-approved attorneys’ fees. Plaintiff attorneys are currently requesting up to 34% of the total settlement fund, which translates to approximately $27.2 million earmarked for legal fees. The proposed agreement also delineates the settlement class into two distinct groups based on the accessibility of the compromised information to unauthorized third parties.
Individuals categorized as “subclass A settlement class members” had their sensitive data compromised yet retained in complex backup files, rendering it less accessible to outside parties. This subgroup includes around 40 million individuals. Conversely, “subclass B settlement class members” had their data stored in a manner that made it more readily accessible to unauthorized third parties, impacting about 22 million individuals. Regardless of the subclass, all affected individuals will automatically receive one year of credit and medical data monitoring, which includes a notable $1 million in identity theft insurance coverage without any deductible.
The cyberattacks that compromised Conduent’s network were initially reported to have commenced around October 21, 2024, continuing unabated until approximately January 13, 2025. During this tumultuous timeframe, unauthorized third parties exploited vulnerabilities in Conduent’s systems, accessing and exfiltrating sensitive data that had been entrusted to them by various clients.
Legal documents describing the incident mention that this type of data breach can be likened to a “hub-and-spoke” model. In this scenario, Conduent acts as the hub storing sensitive information for its client, represented as the spokes. Such a classification underlines the uniqueness of the breaches like this, indicating that they present challenges and complexities that extend beyond more straightforward cases against a single entity affected by a data security incident.
The proposed settlement is pending court approval, and if granted, it will mark a notable chapter in the ongoing discourse surrounding data security within the healthcare industry, addressing the systemic vulnerabilities that have led to this and other similar incidents while providing a path forward for affected individuals.