Conduent Reaches $80 Million Settlement in Class-Action Lawsuit Over 2024 Hack
Back-office support services firm Conduent has agreed to a preliminary $80 million settlement in a class-action lawsuit stemming from a 2024 data breach that impacted approximately 62.2 million individuals.
Conduent, a major provider of business and government back-office support services, has reached a preliminary $80 million settlement to resolve a class-action lawsuit filed in the wake of a significant data breach that occurred in 2024. The breach, which affected an estimated 62.2 million individuals, was the largest health data breach reported in 2025, underscoring the vast scope of sensitive information compromised.
The proposed settlement, filed in a New Jersey federal court, aims to provide financial compensation to affected individuals, offer credit and medical data monitoring services, and commit Conduent to enhancing its cybersecurity infrastructure. The lawsuit alleged that the company failed to adequately protect the sensitive personal information entrusted to it by its clients. Conduent, however, maintains that it denies any wrongdoing or liability in the matter.
Conduent, which spun off from Xerox in 2017, first disclosed the breach in an April 2025 filing with the U.S. Securities and Exchange Commission. The company, which reported $3 billion in revenue in 2025, operates in 22 countries, providing a wide array of services to businesses and governments. The scale of the breach highlights the critical role such third-party service providers play in the data security ecosystem.
According to plaintiffs, the cybercriminal gang SafePay exfiltrated approximately 8.5 terabytes of data from Conduent's IT network. The stolen information reportedly included names, addresses, dates of birth, Social Security numbers, health insurance details, and other sensitive medical information. SafePay, described as a relatively obscure ransomware group, has also been linked to other attacks within the healthcare sector, including a January 2025 incident affecting a North Carolina pathology practice.
The $80 million settlement fund is earmarked to cover various costs, including cash benefits for class members, the provision of monitoring services, settlement administration expenses, and attorneys' fees and costs, with plaintiff attorneys seeking up to 34% of the fund. The settlement structure divides the affected individuals into two subclasses based on the accessibility of their compromised information to unauthorized third parties.
Subclass A members, comprising approximately 40 million individuals, had their information exfiltrated but stored in complex backup files not readily accessible by third parties beyond Conduent. Subclass B, encompassing about 22 million individuals, had their data stored in a manner that made it more readily accessible. All class members are to receive one year of credit or medical data monitoring, along with $1 million in identity theft insurance coverage.
The cyberattack on Conduent's network reportedly began around October 21, 2024, and persisted for nearly three months, concluding in mid-January 2025. During this period, an unauthorized third party gained access to Conduent's systems and extracted data files containing private information. This scenario is often characterized as a "hub-and-spoke" data breach, where a central service provider (the hub) is compromised, affecting data from numerous clients (the spokes), presenting unique challenges in incident response and litigation.
The settlement, while preliminary, represents a significant financial resolution for a breach of this magnitude. It underscores the increasing risks associated with third-party data handling and the substantial legal and financial repercussions that can follow inadequate security measures. The ongoing scrutiny of data protection practices for companies like Conduent highlights the critical need for robust cybersecurity defenses in the modern digital landscape.