Digital platform provider Conduent has agreed to pay $80 million to settle a class action lawsuit stemming from a 2024 cyber incident that exposed the personal and health information of approximately 62 million people. The settlement, filed with the US District Court for the District of New Jersey on October 16, 2026, resolves claims related to what the HIPAA journal ranks as the third largest healthcare data breach of all time. The payment will cover documented financial losses, credit and medical data monitoring services, and plaintiff attorney fees.
The settlement divides affected individuals into two subclasses based on how accessible their stolen information was to attackers. Around 40 million people had their data stored in complex backup files that weren't easily accessible to outside actors, while 22 million had information in readily accessible files. Only victims who can document losses from fraud or identity theft directly tied to the breach can claim cash reimbursement, capped at $3,500 per person. The SafePay ransomware gang allegedly carried out the attack in October 2024, claiming to have stolen 8.5 terabytes of data, though Conduent didn't discover the intrusion for nearly three months.
Following its analysis of compromised files, Conduent notified victims that an unauthorized actor had stolen data potentially including names, addresses, birth dates, Social Security numbers, health insurance information, and medical records. The company emphasized in an 8-K form filed with the Securities and Exchange Commission on October 16 that the settlement "is not an admission of fault or liability," which it denies. Conduent added that it "maintains cyber insurance and does not expect this settlement to have a material impact on its financial position, results of operations or cash flows."
The breach's scale reflects Conduent's extensive reach across sensitive government systems—the firm provides back-office support, document processing, and payment services to roughly 100 million US residents through various government health programs and operates many of the nation's largest toll systems. As part of the settlement, the company has committed to strengthening its data security practices, and if the court grants final approval, Conduent will no longer face civil liability for claims related to the incident. The breach trails only the 2024 Change Healthcare ransomware attack, which affected more than 192 million people, and a 2015 Anthem breach that compromised 78.8 million individuals' data. Organizations handling similarly sensitive government health and payment data face mounting pressure to detect intrusions faster than the three-month gap Conduent experienced, particularly as ransomware groups grow more sophisticated in targeting backup systems where vast troves of protected information sit vulnerable. Insurance coverage may cushion immediate financial blows, but reputational damage from mega-breaches can reshape which vendors governments trust with citizen data going forward.