Conduent Proposes $80 Million Settlement Over Huge Health Data Breach

Conduent, a business services company, has proposed an $80 million settlement over a 2024 data breach that exposed names, Social Security numbers and health information for about 62.2 million people. The deal would end a combined class action lawsuit. A judge has not approved it yet, so no one can claim anything today.

What happened

An unauthorized third party first got into Conduent's network on October 21, 2024. The intruder kept access until January 13, 2025. The SafePay ransomware group claimed it took 8.5 terabytes of data. Conduent told the U.S. Securities and Exchange Commission in April that it had suffered a cybersecurity incident.

Conduent's investigation found that data on roughly 62.2 million people was stolen. It included names, addresses, dates of birth, medical information, health insurance information and Social Security numbers. It was the largest healthcare data breach reported in 2025 and the third-largest of all time.

What the lawsuit says

Several lawsuits were merged into one case in the U.S. District Court for the District of New Jersey. The claim is that Conduent failed to use reasonable safeguards to protect sensitive personal and health data. The case has 16 causes of action, including negligence and violations of several California privacy laws. The defendants disagree with the claims, including claims of wrongdoing and liability.

What people could get

The 62.2 million people are split into two groups. About 40 million are in Subclass A. Their data was stolen but sat in complex backup files that made it hard to access. About 22 million are in Subclass B. Their data was taken in a format that was easy to use.

• Everyone: one year of monitoring, credit for Subclass A and medical data for Subclass B, valued at $179.40.
• Everyone: repayment of documented losses from the breach, up to $3,500 each.
• Subclass B: a pro rata cash payment, meaning a share of what is left in the fund.
• California residents at the time: an extra payment equal to the cash share plus 20%.

The size of the cash share is not known. It depends on what remains after attorneys' fees, administration costs, awards to the lead plaintiffs, monitoring services and claims are paid. The attorneys want 34% of the fund. Each class representative would receive $1,500.

What happens next

The judge must approve the settlement first. After that, dates will be set for objecting, opting out and filing a claim. Those dates are not known yet.

For businesses, the case is a reminder that handing patient or client data to a vendor means sharing the risk. It is worth asking what safeguards those vendors have in place.