Conduent has agreed to pay $80 million to settle a consolidated class action over a cyberattack that exposed personal data on about 62 million people, the business services company disclosed in a securities filing Friday. The deal would also release Conduent's clients from claims over the incident, a reminder that when an outsourcing vendor is breached, the legal fallout reaches the organizations whose customers' data it held.
What Happened
In a Form 8-K filed with the Securities and Exchange Commission, Conduent said it and two subsidiaries, Conduent Business Services LLC and Conduent State & Local Solutions Inc., signed the agreement Oct. 16. It resolves In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, before Judge Michael E. Farbiarz in the U.S. District Court for the District of New Jersey.
Conduent will put the money into a non-reversionary fund, meaning unclaimed amounts do not return to the company. The fund pays class members, credit and medical data monitoring, plaintiffs' lawyers and administration, and it is Conduent's whole monetary obligation.
The settlement agreement filed with the 8-K says an unauthorized party was inside Conduent's network from about Oct. 21, 2024, and took files. Conduent discovered the intrusion around Jan. 13, 2025, and began mailing notification letters in October 2025. The exposed records include combinations of names, Social Security numbers, addresses, birth dates, medical and health insurance information and financial account information.
The class splits into two groups. About 40 million people are in Subclass A, whose data was stored in a complex form not readily usable by outsiders, and about 22 million are in Subclass B, whose data sat in readily accessible files. The agreement says most class members' information reached Conduent through services for their health plans, with fewer through employers or government benefit programs.
Under the terms:
- Every class member automatically gets one year of single-bureau monitoring, credit monitoring for Subclass A and medical data monitoring for Subclass B, each with $1 million in identity theft insurance.
- Members can claim up to $3,500 for documented fraud or identity theft losses.
- Subclass B members can also receive a pro rata cash payment, raised 20% for those who lived in California when the intrusion began.
- Class counsel may ask for up to 34% of the fund in fees, subject to court approval.
Conduent also agreed to give class counsel a confidential declaration on security steps taken since the incident and to make good-faith efforts to meet the HIPAA Security Rule, the federal standard for safeguarding electronic health information.
The agreement is made without any admission of liability or wrongdoing, and Conduent denies the allegations. It needs court approval, and the company warned that the court could materially alter it or fail to approve it. Conduent said it carries cyber insurance and does not expect a material effect on its financial position.
Why It Matters
The class covers about 62 million people, and most of their information reached Conduent through a health plan, employer or benefits program rather than from the people themselves. That is why the release extends to Conduent's clients and their customers, and why boards should read it as a lesson: handing data processing to a vendor moves the work, not the exposure. The class includes people notified by Conduent, by its clients or by both.
The timeline also stands out. Letters began going out roughly nine months after Conduent says it discovered the intrusion, a gap that matters for clients with their own notification duties. Contracts that set notice deadlines, security standards and cost-sharing for vendor breaches are where executives can limit that risk before an incident, not after.
What to Watch
The next step is a motion for preliminary approval. Under the agreement, notices go out within 40 days of that approval, claims are due 75 days after notice begins, and objections and opt-outs are due after 90 days. The court would then set a date for a final approval hearing. Watch for objections to the fee request and, as Conduent's own risk language notes, for other lawsuits or government investigations tied to the incident.
