Conduent agrees to pay $80 million to settle data breach that exposed 62 million people's records

Conduent Incorporated has agreed to pay $80 million to settle class-action lawsuits over a 2024-2025 data breach that exposed personal and medical information belonging to roughly 62 million people, according to a settlement disclosed in a securities filing on Oct. 16. The breach ranks among the largest involving a company that handles health-plan and government back-office work in U.S. history.

Conduent, a Florham Park, New Jersey-based business-process outsourcer that processes billing, mailing and benefits administration for health insurers, state agencies and large employers, said the settlement resolves consolidated litigation in federal court in New Jersey without an admission of wrongdoing. The company said it carries cyber insurance and does not expect the payout to have a material effect on its finances.

The company occupies an unusually invisible but consequential place in American health administration: it does not sell insurance or treat patients, but it processes the paperwork, mailings and benefits files that connect millions of people to the health plans and government programs they rely on. That back-office role is precisely why a single intrusion could expose data belonging to tens of millions of people who had no direct relationship with Conduent and, in many cases, had never heard of the company before receiving a breach notice.

The numbers

The settlement agreement filed with the Securities and Exchange Commission puts the number of affected individuals at approximately 62 million, split into two subclasses: about 40 million people whose data was stored in a complex format not readily accessible to outsiders, and about 22 million whose records — including, for some, medical and health-insurance information — were kept in more easily accessible files. The $80 million fund is described as non-reversionary, meaning any money not claimed will not revert to Conduent; it will instead cover identity-theft insurance and credit or medical monitoring for a year, cash payments of up to $3,500 for documented losses, a 20 percent payment bump for California residents, and attorneys' fees of up to 34 percent of the fund. The unauthorized access is believed to have begun around Oct. 21, 2024, and was discovered by the company on Jan. 13, 2025.

Outside tracking by security researchers has put the federally reported total even higher. The scope of the breach grew substantially after Conduent's initial disclosure, which listed only a few tens of thousands of affected individuals before state regulatory filings and the company's own updates pushed the number past 62 million — placing it behind only the 2024 Change Healthcare breach and the 2015 Anthem breach among U.S. healthcare-linked data compromises by scale.

How the breach unfolded

Conduent's clients span some of the largest names in American health insurance and government services, including divisions tied to Cigna, Elevance Health, Health Care Service Corp. and Humana, according to the settlement agreement, which names several of the health plans whose members' data passed through Conduent's systems. A ransomware group calling itself SafePay claimed responsibility for the intrusion, though Conduent has not confirmed that claim publicly. The case was consolidated before U.S. District Judge Michael E. Farbiarz in the District of New Jersey as In re: Conduent Business Services Data Breach Litigation, and the company first disclosed that it had reached an "agreement in principle" with plaintiffs' lawyers in a separate filing in September, nearly a year after the breach was first discovered.

Who is affected

The settlement class covers tens of millions of people who may never have dealt directly with Conduent, since the company works behind the scenes for insurers and state agencies rather than selling services to consumers itself. For many, the first notice that their Social Security numbers, dates of birth, addresses and in some cases medical or health-insurance records had been exposed came not from Conduent but from one of its client health plans or from a state attorney general's breach notice. State filings tracking the growing scope of the breach, including in Oregon and Texas, showed the estimated number of affected residents climbing for months after the initial disclosure as Conduent's own investigation widened. The settlement also applies to 35 named plaintiffs who sued individually, each eligible for up to $1,500 in addition to the broader class recovery.

Conduent shareholders are a secondary audience for the disclosure: the company told investors it does not expect the $80 million outlay, even after legal fees and administrative costs are added, to materially affect its results, a signal that the settlement was largely priced into its reserves before the filing became public. The announcement arrived a year into a broader leadership transition at the company, which installed a new chief executive, Harsha V. Agadi, in January.

What happens next

The settlement still requires a federal judge's preliminary approval before notice goes out to class members, a process that typically takes months once a hearing is scheduled; no hearing date had been set as of the filing. After preliminary approval, the agreement calls for a claims period, deadlines for objections or opt-outs, and eventually a final-approval hearing, a sequence that in similar large data-breach settlements has stretched beyond a year from signing to final payout. Conduent still faces separate scrutiny beyond the settlement: Missouri's Department of Commerce and Insurance has said in its own widening inquiry into the breach that the company has been "unwilling to provide the department with the information needed" to assess the damage to Missouri policyholders, a characterization Conduent disputes. The federal government's own count of affected individuals, tracked on the Department of Health and Human Services' breach-reporting portal, has been revised upward repeatedly since the initial filing, and the litigation leaves open the question of exactly how the intruders first gained access — a detail the settlement agreement itself does not resolve.