Conduent agrees to $80M data breach settlement covering about 62 million people

Estimated reading time: 9 minutes.

Key facts

What happened: Conduent agreed on October 16, 2026 to pay $80 million to settle the consolidated class action over its 2024 to 2025 data breach. The company disclosed the deal in an SEC filing the same day.
Who is covered: About 62 million people in the U.S. who received a notice from Conduent or one of its clients saying their information may have been affected.
Automatic benefit: Every class member would receive one year of credit monitoring or medical data monitoring with $1 million in identity theft insurance, without filing a claim.
Cash: Class members with documented losses could claim up to $3,500. About 22 million people in "Subclass B" could also choose a pro rata cash payment, with a 20% increase for California residents.
Not final: The court has not yet granted preliminary approval. There is no settlement website, claim form or deadline yet.
The case: In re Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, U.S. District Court for the District of New Jersey, before Judge Michael E. Farbiarz.
No admission: Conduent denies fault and liability.

What Conduent agreed to

Conduent Incorporated and two subsidiaries, Conduent Business Services, LLC and Conduent State & Local Solutions, Inc., signed a class action settlement agreement with the plaintiffs on October 16, 2026. The company filed the agreement with a Form 8-K report to the U.S. Securities and Exchange Commission that day.

Conduent will pay $80 million into a non-reversionary settlement fund. Non-reversionary means none of the money goes back to Conduent, even if fewer people claim than expected. The fund must cover payments to class members, the cost of monitoring services, attorneys' fees, service awards and administration costs. The 8-K describes the $80 million as Conduent's total monetary obligation under the deal.

If the court gives final approval, the settlement releases claims about the incident against Conduent, its affected clients and those clients' affected customers.

The 8-K says the agreement "is not an admission of fault or liability, which the Company denies." Conduent also said it maintains cyber insurance and does not expect the settlement to have a material impact on its financial position, results of operations or cash flows.

What happened in the data breach

The settlement agreement summarizes the incident. On or about January 13, 2025, Conduent discovered that an unauthorized third party had accessed its networks starting on or about October 21, 2024, and taken files.

Those files contained private information of about 62 million people. The agreement's definition of private information includes names, Social Security numbers, addresses, dates of birth, medical information, health insurance information and financial account information. Not everyone's file contained every type of data.

Beginning in October 2025, after what the agreement calls an extensive investigation, Conduent and its clients sent notification letters to affected individuals.

Check your mail and email

The class is built from Conduent's notice list. If you received a Conduent breach letter, directly or through a health plan or other client, you are likely on that list. Keep the letter.

Who the parties are

Conduent is a New Jersey based company that provides business process services, such as handling payments, claims and records, for commercial and government clients. Many people affected by the breach had never dealt with Conduent directly. Their information reached Conduent through a client.

The client defendants. The operative complaint also sued five Conduent clients: AIG Procurement Services, Inc., The Cigna Group, Inc., Elevance Health, Inc., Health Care Service Corporation and Humana, Inc. Blue Shield of California was named in the first consolidated complaint but not the current one.

The lawyers. The court appointed Jeff Ostrow of Kopelowitz Ostrow and James E. Cecchi of Carella Byrne as interim co-lead counsel for the plaintiffs. Holland & Knight represents Conduent.

How the lawsuit got here

More than 30 lawsuits were filed against Conduent starting around October 27, 2025. The court consolidated them on November 24, 2025.

The plaintiffs filed a consolidated complaint on March 18, 2026, and an amended consolidated complaint on June 12, 2026. The amended complaint, the operative one, was brought by 35 plaintiffs living in 18 states and asserts 16 causes of action against Conduent and the client defendants.

The parties then held a mediation in Philadelphia on August 13, 2026 with Hon. Diane M. Welsh (Ret.), a former U.S. Magistrate Judge who now works with JAMS. The agreement says class counsel consulted damages and liability experts and received informal discovery from Conduent before the mediation. The signed agreement followed in October.

Who qualifies and what you could get

The class. The proposed settlement class is everyone residing in the U.S. who is on the class list and was sent actual or substitute notice by Conduent or its clients that their information may have been affected. Conduent and its insiders, court staff, people who opt out, and people who already released their claims are excluded.

The class is split into two subclasses based on how the stolen data was stored:

Subclass A: about 40 million people whose data, according to the agreement, was stored in a complex way that made it not readily accessible to outsiders.
Subclass B: about 22 million people whose data was in files where it was readily accessible.

Monitoring for everyone, no claim needed. All class members would automatically get one year of monitoring with one credit bureau, provided by CyEx, Inc. Subclass A would receive Financial Shield, which monitors bank, investment and credit card accounts and includes dark web scanning. Subclass B would receive Medical Shield, which watches online marketplaces where medical information is traded. Both include $1 million in identity theft insurance with no deductible. An activation code would arrive in the email notice, to be used after the settlement becomes final.

Documented losses, up to $3,500. Any class member could claim reimbursement for unreimbursed fraud or identity theft losses with documentation. The agreement requires that the loss more likely than not resulted from the incident and occurred after it.

Pro rata cash, Subclass B only. Subclass B members could also choose a pro rata cash payment, an equal share of money left in the fund after other costs. The amount is not known. Subclass B members who lived in California on October 21, 2024 would receive 20% more, and must attest to that under penalty of perjury. The agreement's example: if the standard payment were $50, a California member would get $60.

Do not pay anyone to file

Filing a claim in a class action settlement is free. Once a court approves the notice plan, use only the official settlement website and phone number listed in your notice.

Attorneys' fees. The agreement says class counsel will ask for up to 34% of the settlement fund, about $27.2 million if the full amount is awarded, plus costs. It also says counsel will request service awards of up to $1,500 for each class representative. The court decides these amounts and may award less.

Other terms. Conduent agreed to give class counsel a confidential declaration describing the steps it took after the incident to better protect class members' information. It also agreed to make good-faith efforts to commit the resources needed to meet HIPAA security requirements. Leftover money that cannot be distributed would go to a cy pres recipient, an organization chosen by the parties and approved by the court.

For other open claims, browse our list of class action cases you can join.

Timeline and next steps

The settlement still needs court approval. The agreement sets these steps, counted from preliminary approval and notice:

Notice: The proposed administrator, Epiq Class Action & Claims Solutions, Inc., would begin email and publication notice within 40 days after preliminary approval. A reminder email would follow.
Claim deadline: 75 days after notice begins.
Opt-out and objection deadlines: 90 days after notice begins.
Final approval hearing: to be scheduled by the court.
Payments: sent electronically within 60 days after the settlement becomes final.

None of these dates exist yet, because Judge Farbiarz has not ruled on preliminary approval.

Approval is not guaranteed

A judge reviews every class settlement for fairness. Until Judge Farbiarz approves the deal and notice goes out, there is nothing to file and no deadline is running.

What remains unclear

The settlement website and toll-free number are placeholders in the agreement. The pro rata payment amount depends on how many people claim and what remains after fees, monitoring and administration. The agreement does not say how many people in each subclass have usable email addresses, though it addresses notice by email and publication.

The agreement also does not say who carried out the intrusion or how the attacker got in. The judge could reject the deal or ask the parties to change it.

Frequently asked questions

Am I part of the Conduent data breach settlement?

You are likely included if you live in the U.S. and received a notice from Conduent or one of its clients saying your information may have been affected. The class list controls.

How much money can I get?

Up to $3,500 for documented losses. Subclass B members can choose a pro rata payment instead or in addition, with an amount not yet known. California Subclass B members get 20% more.

Do I need to file a claim for credit monitoring?

No. The agreement says all class members receive one year of monitoring automatically. You would activate it with the code in your notice.

Is there a claim deadline?

Not yet. The deadline would be 75 days after notice begins, which depends on preliminary approval.

Did Conduent admit wrongdoing?

No. Conduent denies fault and liability, and the settlement is not an admission.

How do I know if I am in Subclass A or Subclass B?

The agreement assigns subclasses based on how your data was stored. Your notice should tell you which benefits apply to you.