Conduent Agrees to Pay $80m to Settle Data Breach Class Action
Conduent Agrees to Pay $80m to Settle Data Breach Class Action
Digital platform provider Conduent has agreed to pay $80 million to settle a class action lawsuit following a 2024 cyber incident that breached the personal and health data of around 62 million people. The settlement will cover material losses experienced by individual claimants whose personal data was compromised, as well as the costs of credit monitoring and medical data monitoring services for each claimant, including the plaintiff’s legal fees. 🚀
A filing submitted to the US District Court for the District of New Jersey on October 16, 2026 explained that the agreement divides the claimants into two subclasses. One consists of around 40 million individuals whose stolen data was stored in complex backup files that were not readily accessible to third-party actors. The second subclass relates to 22 million individuals whose stolen data was stored in files that were readily accessible. Only those plaintiffs who have documented losses relating to fraud and/or identity theft stemming from the incident can claim a direct cash reimbursement, up to a maximum value of $3,500. Conduent has also agreed to strengthen its data security practices as part of the settlement. 🔒
The settlement agreement was confirmed by Conduent in an 8-K filing submitted to the US Securities and Exchange Commission (SEC) on October 16. It emphasized that the agreement is not an admission of fault or liability, which Conduent denies. The attack on Conduent was allegedly perpetrated by the SafePay ransomware gang, which claimed it had stolen 8.5TB of data from the firm. The incident took place in October 2024 but was not discovered by Conduent for almost three months. Following analysis of the impacted files, Conduent informed affected individuals that an unauthorized actor exfiltrated data that may have included names, addresses, dates of birth, Social Security numbers, health insurance details, and medical information. 📉
The Health Insurance Portability and Accountability Act (HIPAA) journal ranks this incident as the third largest healthcare data breach of all time, as of October 2026, due to the number of individuals’ protected health information that was compromised. First place on that list remains the 2024 ransomware attack on the healthcare payment processing provider Change Healthcare, which affected more than 192 million people. This is followed by an incident that hit US health insurance giant Anthem in 2015, which HIPAA recorded as breaching the data of 78.8 million people.