Healthcare
,
Industry Specific
,
Litigation
Data Theft From Back Office Services Firm Affected 62.2 Million
Marianne Kolbasuk McGee (HealthInfoSec) •
October 18, 2026
Back office support services firm Conduent and plaintiffs have reached a preliminary $80 million class action lawsuit stemming for a 2024 hack that affected 62.2 million people. (Image: Conduent)
Plaintiffs representing about 62.2 million affected individuals reached a preliminary $80 million settlement of proposed class-action litigation against Conduent stemming from a 2024 hack on the back-office support services firm.See Also: The Healthcare CISO’s Guide to Medical IoT Security
The proposed agreement, filed Friday in a New Jersey federal court, includes financial compensation for affected individuals, credit and medical data monitoring, and a commitment by Conduent to strengthen its cybersecurity.
The settlement would resolve allegations that Conduent failed to adequately safeguard sensitive personal information. The firm denies any wrongdoing or liability.
Conduent, a 2017 spin-off company of Xerox, in first publicly disclosed the hack in an April 2025 filing to the U.S. Securities and Exchange Commission (see: Conduent Hack Victim Count Now Tops 62.2 Million).
The Conduent hack was the largest health data breach reported in 2025.
The company provides a wide range of back-office support services to businesses and governments in 22 countries. It reported $3 billion in revenue in 2025.
Plaintiffs alleged that cybercriminal gang SafePay exfiltrated approximately 8.5 terabytes of data from the company’s IT network. That information included individuals’ names, addresses, dates of birth, Social Security numbers, health insurance details and medical information.
SafePay, a relatively obscure ransomware group, has been linked to other hacks on the healthcare sector, including a January 2025 attack on North Carolina pathology practice Marlboro-Chesterfield Pathology (see: NC Pathology Practice Notifying 236,000 of Data Theft Hack).
The $80 million proposed settlement fund would cover cash benefits, monitoring services, settlement administration expenses, court-approved attorneys’ fees and costs, and payments to class representatives.
Plaintiff attorneys are requesting to receive up to 34% of the settlement fund, or about $27.2 million for fees.
The proposed agreement divides the settlement class into two groups according to how accessible the compromised information was to unauthorized third parties.
Individuals are considered a “subclass A settlement class member” if their private information was exfiltrated in the data incident but their information was maintained “in complex backup files” and not readily accessible by third parties other than Conduent,” according to court documents. This subclass includes about 40 million people.
Subclass B settlement class members are individuals whose private information was exfiltrated in the hack and their private information was stored “in a manner making the data readily accessible to third parties.” This subclass includes about 22 million individuals.
All class members would automatically receive one year of credit or medical data monitoring, including $1 million in identity theft insurance coverage with no deductible.
The cyberattack on Conduent’s network began on or about Oct. 21, 2024, and continued for nearly three months, until approximately Jan. 13, 2025. “During that time, an unauthorized third party accessed Conduent’s systems and exfiltrated data files containing Private Information entrusted to Conduent by Conduent’s clients,” court documents said.
“This type of data security case is often referred to as a hub-and-spoke data breach in the sense that Conduent – the hub – suffered the data incident while in possession of private information provided to Conduent by Conduent’s clients – the spokes,” the proposed settlement document said.
“A hub-and-spoke case presents challenges different from, and more complex than, a straightforward case against a single defendant which was impacted by a security incident.”
Click Here For The Original Source.
——————————————————–
