CONDUENT has agreed to pay $80 million to settle a class action linked to a 2024 cyber incident that exposed personal and health data for about 62 million people. The filing to the US District Court for the District of New Jersey on 16 October 2026 outlines the settlement, which provides material loss coverage and credit/medical monitoring for claimants, plus the plaintiff’s legal fees.
The claimants are divided into two subclasses: around 40 million individuals whose data was stored in complex backups not readily accessible to third parties, and around 22 million whose data was kept in files that were readily accessible. Eligible claimants with documented losses from fraud or identity theft may receive a direct cash reimbursement of up to $3,500, subject to final court approval. If approved, Conduent would settle civil claims arising from the incident and commit to enhanced data security practices.
The breach, attributed by Infosecurity to the SafePay ransomware gang, occurred in October 2024 and was not detected for nearly three months. Affected records potentially included names, addresses, dates of birth, Social Security numbers, health insurance details and medical information. HIPAA rankings place this as the third largest healthcare data breach by October 2026, with Change Healthcare and Anthem occupying the top two spots in the broader context of health information breaches.
Conduent, which provides government-facing printing, processing and payment services, states the settlement is not an admission of fault and notes it holds cyber insurance; the firm does not expect material impacts on its financial position.