Conduent Agrees to $80 Million Class Action Data Breach Settlement
Conduent, a leading provider of back-office business services through Conduent Business Services LLC, experienced a massive data breach in 2024 that resulted in the theft of the personal and protected health information of 62.2 million individuals. Conduent faced multiple class action lawsuits in response to the data breach, and a settlement has now been agreed to bring the litigation to an end with no admission of liability or wrongdoing by Conduent.
The data breach ranks as the third-largest ever to be reported by a HIPAA-regulated entity, behind the 2024 cyberattack on Change Healthcare and the 2015 hack of Anthem Inc. The SafePay ransomware group first gained access to Conduent’s network in October 2024 and remained undetected for three months until January 2025. SafePay claimed to have exfiltrated 8.5 TB of data. The U.S. Securities and Exchange Commission (SEC) was notified about the data breach in April 2025. The forensic investigation determined that the stolen data included names, contact information, dates of birth, Social Security numbers, medical information, and health insurance information.
Conduent has agreed to pay $80 million to resolve all claims related to the data breach, inclusive of attorneys’ fees and expenses, settlement administration and notice costs, service awards for the lead plaintiffs, and benefits for the 62.2 million class members. The settlement agreement was filed in the U.S. District Court for the District of New Jersey last week and will resolve the consolidated class action lawsuit: In Re Conduent Business Services Data Breach Litigation.
Conduent will establish an $80,000,000 settlement fund, has made enhancements to data security, and says it is committed to ensuring compliance with all requirements of the HIPAA Security Rule. The settlement is divided into two subclasses. Subclass A includes individuals whose data was stolen in a complex form that is difficult to access. Subclass B consists of individuals whose data was stolen in an easily accessible format. All class members will be entitled to receive one year of credit monitoring or medical data monitoring services valued at $179.40 per year. Subclass A individuals are entitled to credit monitoring services, and Subclass B individuals are entitled to claim medical data monitoring services.
Regardless of the Subclass, claims may be submitted for up to $3,500 as reimbursement of documented, unreimbursed losses. Members of Subclass B may also claim a pro rata cash payment. California residents at the time of the breach are also entitled to claim an additional payment, which will be 20% more than the pro rata cash payment amount. The settlement now awaits approval from the court. Class members will be provided with an opportunity to object to or exclude themselves from the settlement.
