The October 2024 incident exposed health and personal data on about 62 million people, and the settlement splits them into two groups.

 

What happened

Conduent has agreed to pay $80 million to settle a class action lawsuit over a 2024 cyberattack that exposed the personal and health information of around 62 million people, Infosecurity Magazine reported on October 19, 2026. The proposed settlement was filed with the US District Court for the District of New Jersey on October 16. Conduent provides printing, mailroom, document processing, and payment services, and supports about 100 million US residents across government health programs. The attack took place in October 2024 and went undetected for almost three months. Exposed data may have included names, addresses, dates of birth, Social Security numbers, health insurance details, and medical information. The settlement still needs final court approval.

 

Going deeper

The settlement divides the people affected into two groups based on how reachable their data was, according to the court filing. About 40 million people had data stored in complex backup files that were not readily accessible, while about 22 million had data in files that were. The $80 million covers documented losses, credit monitoring and medical data monitoring for claimants, and the plaintiffs' legal fees. Only people with documented losses from fraud or identity theft linked to the incident can claim direct cash reimbursement, up to $3,500 each. Conduent has also agreed to strengthen its data security practices.

 

What was said

The settlement is not an admission of fault or liability, which Conduent denies, the company said in its filing with the Securities and Exchange Commission on October 16. "The Company maintains cyber insurance and does not expect this settlement to have a material impact on its financial position, results of operations or cash flows," the filing states. If the court gives final approval, Conduent will no longer face civil claims over the incident.

 

In the know

The ransomware group SafePay is alleged to have carried out the attack and claimed to have taken 8.5 terabytes of data. SafePay first appeared in October 2024 and quickly became one of the most active groups, Infosecurity Magazine reported in a profile of the group. Researchers quoted there say its methods resemble those of the defunct Conti gang, including flooding victims with spam and then calling them on Microsoft Teams while posing as the company's IT department. The group runs its own operation rather than renting its ransomware to affiliates, and it typically sets demands at 1% to 3% of a victim's annual revenue. Its targets were mostly in finance, legal, and insurance at first, before shifting to include healthcare and critical services.

 

The big picture

The split between backup files and readily accessible files shows how much a breach's impact depends on where data sits and how it is stored. Hacking and IT incidents accounted for 88% of all patient records exposed between 2010 and 2024, according to a cross-sectional analysis in JAMA Network Open covering HIPAA-regulated entities, with ransomware rising from no recorded cases in 2010 to more than 30% of breaches by 2021. When a single vendor processes records for government health programs serving tens of millions of people, one intrusion reaches all of them. Healthcare organizations using vendors like Conduent can ask what data those vendors hold on their behalf, how long they keep it, and whether backup copies are encrypted and stored separately from the systems people use every day.

 

FAQs

Who qualifies for a cash payment?

Only people with documented losses from fraud or identity theft connected to the incident, up to $3,500 each. Others in the class can receive credit and medical data monitoring.

 

Why does it matter whether data was in backup files?

Data in backups that are hard to read or open is less exposed than data in files an attacker can use straight away. The settlement treats the two groups separately for that reason.

 

Does settling mean Conduent admitted wrongdoing?

No. The company says the agreement is not an admission of fault or liability, and it denies any.

 

What happens next?

The court has to give final approval. Until then, the terms can still change, and no payments are made.

 

What should people affected by the breach watch for?

Unfamiliar charges, new accounts opened in their name, or an explanation of benefits statement showing care they didn't receive. Medical data monitoring can help spot misuse of health insurance details.