.jpg)
Digital platform provider Conduent has agreed to pay $80m to settle a class action lawsuit following a 2024 cyber incident that breached the personal and health data of around 62 million people.
The money will be divided up into covering material losses experienced by individual claimants whose personal data was breached, the costs of credit monitoring and medical data monitoring services for each of the claimants and the plaintiff’s legal fees.
A filing submitted to the US District Court for the District of New Jersey on October 16, 2026 explained that the agreement divides the claimants into two subclasses.
One consists of around 40 million individuals whose stolen data was stored in complex backup files that were not readily accessible to third party actors. The second relates to 22 million individuals who stolen data was stored in files that were readily accessible.
Only those plaintiffs who have documented losses relating to fraud and/or identity theft stemming from the incident can claim a direct cash reimbursement, up to a maximum value of $3500.
If the settlement receives final approval from the Court, Conduent will no longer be liable for civil claims relating to the cyber incident.
The business services firm has also agreed to strengthen its data security practices as part of the settlement.
The settlement agreement was confirmed by Conduent in an 8-K filing form submitted to the US Securities and Exchange Commission (SEC) on October 16.
It emphasized that the agreement is not an admission of fault or liability, which Conduent denies.
“The Company maintains cyber insurance and does not expect this settlement to have a material impact on its financial position, results of operations or cash flows,” the filing added.
Conduent provides third-party printing/mailroom services, document processing services, payment integrity services and other back-office support services. The company supports approximately 100 million US residents across various government health programs, operates many of the largest toll systems in the US and is a provider of government payment disbursements for federally funded benefit and payment card programs.
Third Largest Healthcare Data Breach of All Time
The attack on Conduent was allegedly perpetrated by the SafePay ransomware gang, which claimed it had stolen 8.5TB of data from the firm.
The incident took place in October 2024 but was not discovered by Conduent for almost three months.
Following analysis of the impacted files, Conduent told affected individuals that an unauthorized actor exfiltrated data that may have included names, addresses, dates of birth, Social Security numbers, health insurance details and medical information.
The Health Insurance Portability and Accountability Act (HIPAA) journal ranks the incident as the third largest healthcare data beach of all time, as of October 2026, due the number of individuals’ protected health information that was compromised.
First place on that list remains the 2024 ransomware attack on the healthcare payment processing provider Change Healthcare, which has affected more than 192 million people.
This is followed by an incident which hit US health insurance giant Anthem in 2015, which HIPAA recorded as breaching the data of 78.8 million people.
.jpeg)
