Around 62 million people had personal and health data exposed in a 2024 cyber incident tied to Conduent, and the company has agreed to an $80 million settlement that would allocate money for individual losses, monitoring services and legal fees.
How the $80 million is allocated and the class breakdown
The October 16, 2026 filing in the U.S. District Court for the District of New Jersey lays out an $80 million settlement that will be divided among three broad uses: cash reimbursements for documented material losses suffered by claimants, the costs of credit monitoring and medical data monitoring for claimants, and the plaintiff’s legal fees. The agreement separates affected people into two subclasses: roughly 40 million individuals whose stolen data was stored in complex backup files “not readily accessible to third party actors,” and about 22 million whose stolen data was stored in files described as “readily accessible.”
Who can get money — and how much
Only plaintiffs who can document losses tied to fraud or identity theft resulting from the incident are eligible for direct cash reimbursement, and those payments are capped at $3,500 per claimant. The filing makes clear that, if the settlement receives final court approval, Conduent will no longer be liable for civil claims relating to the cyber incident.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadThe incident itself: timing, claims, and data types
The attack occurred in October 2024 but, according to Conduent’s disclosures, the company did not discover it for almost three months. The breach was allegedly carried out by the SafePay ransomware gang, which claimed to have stolen 8.5TB of data. After reviewing impacted files, Conduent told affected individuals that an unauthorized actor exfiltrated information that may have included names, addresses, dates of birth, Social Security numbers, health insurance details and medical information.
Conduent’s public position and agreed security steps
Conduent confirmed the settlement in an 8‑K filing with the Securities and Exchange Commission on October 16, 2026, and emphasized that the agreement “is not an admission of fault or liability, which Conduent denies.” The filing also stated, “The Company maintains cyber insurance and does not expect this settlement to have a material impact on its financial position, results of operations or cash flows.” As part of the settlement Conduent has agreed to strengthen its data security practices.
What this means for affected individuals, government health programs, and legal claimants
- Affected individuals: Those in the two subclasses will be eligible for credit monitoring and medical data monitoring services; cash reimbursements are limited to claimants who can provide documentation of fraud or identity-theft losses, up to $3,500.
- Government health programs and benefit recipients: Conduent supports approximately 100 million U.S. residents across various government health programs and also provides government payment disbursements and toll system operations. The settlement, if finally approved, would remove civil liability for Conduent tied to this incident — a legal change with direct relevance to the many federally funded services the company supports.
- Legal claimants and counsel: The settlement explicitly allocates funds to plaintiff legal fees and differentiates claimants by the accessibility of the breached files, a distinction that will shape which individuals qualify for cash reimbursement.
The settlement places a monetary ceiling on Conduent’s civil exposure without conceding fault, and it frames compensation around documented loss rather than automatic per-person payouts. The breach remains, by scale, one of the largest in recent healthcare history: the HIPAA journal classifies Conduent’s incident as the third largest healthcare data breach of all time as of October 2026 — behind a 2024 attack on Change Healthcare affecting more than 192 million people and the 2015 Anthem incident recorded at 78.8 million.
The court will next consider final approval of the settlement; if granted, it will close the civil avenue against Conduent for this cyber incident while obliging the firm to enhance data security and to fund monitoring and claims processes for millions of affected people.
Original reporting: Infosecurity Magazine — “Conduent Agrees to Pay $80m to Settle Data Breach Class Action”
