Conduent has agreed to pay $80 million to settle a consolidated class action over a breach in which an unauthorized third party exfiltrated files containing the private information of about 62 million people. The company signed the settlement on October 16, 2026, and disclosed it in a Form 8-K dated the same day, under Item 1.01. The agreement still needs approval from the U.S. District Court for the District of New Jersey.
The case is In re: Conduent Business Services Data Breach Litigation (Case No. 2:25-cv-16953). The settling defendants are Conduent Incorporated, Conduent Business Services, LLC, and Conduent State & Local Solutions, Inc. In the 8-K, Conduent says the litigation arises from its "previously disclosed January 2025 cybersecurity incident."
What happened
January 2025 is when the incident was discovered, not when it began. According to the settlement agreement, filed as Exhibit 10.1 to the 8-K, Conduent discovered that an unauthorized third party had accessed its networks "beginning on or about October 21, 2024." The agreement says the exfiltrated files contained the private information of "approximately 62 million individuals." Conduent and its clients began sending notification letters in October 2025.
Infosecurity Magazine, which called the event a "2024 cyber incident," reported that Conduent did not discover the intrusion for almost three months. According to Infosecurity, Conduent said the exposed data may have included names, addresses, dates of birth, Social Security numbers, health insurance details, and medical information. Citing HIPAA Journal, Infosecurity reported that the breach is the third-largest healthcare data breach on record as of October 2026. Only two are larger: the Change Healthcare ransomware attack (more than 192 million people) and the 2015 Anthem breach (78.8 million).
What's confirmed and what's claimed
The intrusion, the exfiltration, the start date, and the victim count all come from Conduent's own filings. The identity of the attacker does not. Infosecurity reported that the SafePay ransomware group allegedly carried out the attack, and that the group claimed to have stolen 8.5TB of data. That figure comes from the group alone. Neither the settlement agreement nor the 8-K names an attacker or gives a data volume.
Conduent denies liability. The 8-K says the settlement "is not an admission of fault or liability," says the company maintains cyber insurance, and says Conduent does not expect the settlement to have a material impact on its financial position, results of operations, or cash flows.
How the $80 million is structured
The fund is non-reversionary, so unclaimed money does not go back to Conduent. According to the 8-K, the fund pays for class member recovery, credit and medical data monitoring, plaintiffs' counsel fees, and settlement administration costs. The 8-K also says the $80 million is Conduent's total monetary obligation under the agreement.
The agreement splits the class in two based on how the stolen data was stored:
- Subclass A: about 40 million people whose data, according to the agreement, was "maintained in a complex manner such that the data was not readily accessible" by third parties.
- Subclass B: about 22 million people whose data "was stored in files wherein the data was readily accessible."
The benefits differ by subclass:
- Documented losses: any class member can claim up to $3,500.00 for losses that are documented, unreimbursed, and more likely than not caused by the incident.
- Pro rata cash: only Subclass B members can choose this payment. It is a share of whatever remains in the Net Settlement Fund.
- California Statutory Payment: Subclass B members who lived in California on October 21, 2024, receive a 20% upward adjustment to their pro rata payment. To get it, they must attest under penalty of perjury that they lived in California on that date.
- Monitoring: one year with one credit bureau. Subclass A members get credit monitoring (Financial Shield, through CyEx, Inc.). Subclass B members get medical data monitoring (Medical Shield, also through CyEx). Both products include $1,000,000 in identity theft insurance with no deductible.
The agreement says Conduent will make good-faith efforts to commit enough resources to meet the security requirements of the HIPAA Security Rule. Infosecurity described this as an agreement to strengthen its data security practices.
The opt-out and objection deadlines fall 90 days after notice to the class begins. The court has not approved the settlement yet, so those dates have not been set.
Who the settlement covers
Once the settlement is approved, the release covers Conduent, its affected clients, and those clients' affected customers, for claims connected to the incident. The agreement names five clients as defendants: AIG Procurement Services, The Cigna Group, Elevance Health, Health Care Service Corporation, and Humana.
How a person's data was stored decides which benefits they can claim. Both subclasses are in the class, but only Subclass B, whose data sat in readily accessible files, can choose pro rata cash and the California adjustment. The two subclasses also get different monitoring products.
What It Means for Defenders
- Find out what your processors hold, and in what form. The settlement set different benefits depending on whether data was readily accessible. Ask third-party processors which of your records they keep in readily usable form, and push them to keep that set as small as possible.
- Put detection and notification deadlines in vendor contracts. Conduent discovered the intrusion about 12 weeks after it began (Oct. 21, 2024 to Jan. 13, 2025), and notification letters began about nine months after discovery, in October 2025.
- Test how quickly you would spot bulk exfiltration. Check that your logging and alerting would flag large outbound transfers from file stores and backups.
- Tell affected staff and customers what to do. Anyone who received a Conduent notice should keep records of any losses and watch for the settlement notice, which will give the claim, opt-out, and objection deadlines.
