Business services firm Conduent has agreed to pay $80 million to settle a class action lawsuit over a 2024 cyberattack that exposed the personal and health data of about 62 million people. The proposed settlement was filed on 16 October 2026 in the US District Court for the District of New Jersey, and the company confirmed the agreement in a filing with the US Securities and Exchange Commission the same day.

The incident began with unauthorised access to Conduent's network on or about 21 October 2024 and continued for nearly three months, until around 13 January 2025. Reporting attributes the attack to the SafePay ransomware operation, which claimed to have stolen 8.5 terabytes of data. The stolen information included names, addresses, dates of birth, Social Security numbers, health insurance details and medical information. Conduent first disclosed the hack in an SEC filing in April 2025, and the incident was the largest health data breach reported in 2025. The HIPAA Journal ranks it the third-largest healthcare data breach of all time.

Under the proposed terms, the $80 million fund is non-reversionary, meaning none of it returns to Conduent. It covers cash payments for documented losses of up to $3,500 per claimant, a year of credit and medical-data monitoring, settlement administration, service awards and the plaintiffs' legal fees, with the lawyers seeking up to 34 percent of the fund, about $27.2 million. The roughly 62.2 million affected people are split into two subclasses: about 40 million whose data sat in complex backup files that were not readily accessible, and about 22 million whose data was stored in a readily accessible format, who also have a pro-rata cash payment option.

The deal is not yet final. Conduent denies any wrongdoing, and the settlement is not an admission of fault. A judge asked for more case-specific detail on 22 October before granting preliminary approval, and the preliminary-approval hearing is scheduled for 11 December 2026. The claims process is not open: there is no claim form, settlement website or payment date yet, and claims would fall due 75 days after the notice process begins.