Conduent agrees to $80 million settlement over major breach

Conduent has agreed to an $80 million settlement to resolve class-action litigation stemming from what is described as the third-largest healthcare data breach on record, affecting about 62.2 million individuals. The agreement, signed on 16 October 2026 and filed with the U.S. Securities and Exchange Commission, would establish a nonreversionary fund to cover class member recoveries, credit and medical monitoring, plaintiffs’ attorney fees and administration costs.

Conduent says it denies fault and that cyber insurance is in place; if approved by the court, the settlement would release Conduent’s affected clients and those clients’ customers from related claims. The company maintains the settlement should not have a material financial impact.

The breach involved an unauthorised third party gaining access to Conduent’s network from 21 October 2024 to 13 January 2025, exposing names, addresses, birth dates, medical information, health insurance information and Social Security numbers. The SafePay ransomware group claimed it stole 8.5 terabytes of data.

The disclosures note that the case, the settlement terms and the underlying incident are subject to court approval, and that Conduent continues to respond to the incident with its cyber-insurance coverage in place, while asserting no fault.