Conduent to Pay $80m Over 2024 Breach That Exposed Data of 62 Million People

Conduent, a digital platform and back-office services provider, has agreed to pay $80m to settle a class action lawsuit. The case stems from an October 2024 cyber incident that breached the personal and health data of around 62 million people. The attack was allegedly carried out by the SafePay ransomware gang, which claimed it had stolen 8.5TB of data. Conduent did not discover the incident for almost three months.

The settlement will cover claimants' material losses, credit monitoring and medical data monitoring services, and the plaintiffs' legal fees. Claimants are split into two groups: about 40 million people whose data was held in complex backup files that were not readily accessible to outsiders, and 22 million whose data was in readily accessible files. Only those with documented losses from fraud or identity theft linked to the incident can claim direct cash reimbursement, up to $3500. Conduent has also agreed to strengthen its data security practices. If the court gives final approval, the company will no longer be liable for civil claims related to the incident.

In an 8-K filing to the US Securities and Exchange Commission, Conduent stated the agreement is not an admission of fault or liability, which it denies. It said it holds cyber insurance and does not expect a material financial impact. The company provides printing, mailroom, document processing and payment services, and supports government health programs, toll systems and benefit payment programs in the US.