$80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation
An $80 million settlement has been proposed to resolve a consolidated class action lawsuit against Conduent Business Services, LLC, over its 2024 cybersecurity incident and data breach. Conduent, a leading provider of front-office and back-office solutions, notified the U.S. Securities and Exchange Commission (SEC) in April that it had experienced a cybersecurity incident. An unauthorized third party first breached its network on October 21, 2024, and maintained access until January 13, 2025. The SafePay ransomware group claimed to have exfiltrated 8.5 terabytes of data in the attack.
Conduent’s forensic investigation determined that the personal and protected health information of approximately 62.2 million individuals was stolen in the incident, including names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers. It was the largest healthcare data breach reported in 2025 and ranks as the third-largest healthcare data breach of all time.
Conduent Business Services LLC, Conduent State & Local Solutions, Inc., and Conduent Incorporated faced multiple class action lawsuits in response to the data breach. The lawsuits were consolidated into a single complaint – In Re Conduent Business Services Data Breach Litigation – as they had overlapping claims and classes. The lawsuit is pending in the U.S. District Court for the District of New Jersey.
The consolidated lawsuit alleged that the defendants failed to implement reasonable and appropriate safeguards to protect individuals’ sensitive personal and protected health information. The lawsuit had 16 causes of action, including negligence and violations of the California Consumer Privacy Act, California Confidentiality of Medical Information Act, and California Customer Records Act. The defendants disagree with the claims and contentions in the lawsuit, including claims of wrongdoing and liability.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The $80 million settlement was proposed following mediation and covers the 62.2 million individuals affected by the breach, approximately 40 million of whom are in Subclass A and 22 million are in Subclass B. Individuals in Subclass A had data stolen in the attack, but it was stored in complex backup files that made their data difficult to access. Individuals in Subclass B had private information stolen in a readily accessible format.
All class members are entitled to claim one year of single-bureau credit monitoring services, valued at $179.40 per year. All class members may also submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $3,500 per class member. Members of subclass B may also submit a claim for a pro rata cash payment, the value of which will depend on the remaining funds after attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, credit monitoring services, and claims have been paid. The attorneys are seeking 34% of the settlement fund, and the class representatives will be paid $1,500 each. Individuals who were California residents at the time of the breach will also be eligible for an additional payment, equal to the pro rata cash payment plus 20%. The settlement awaits approval from the court, after which the dates for objection, exclusion, and submitting a claim will be set.
