Conduent agrees to $80 million settlement after massive healthcare data breach
Conduent has agreed to pay $80 million to resolve class action litigation tied to one of the largest healthcare data breaches on record, a compromise built around a disclosure that exposed data belonging to about 62.2 million people. The settlement was signed Oct. 16 in U.S. District Court for the District of New Jersey, according to an SEC filing, and it is structured as a nonreversionary fund covering class member recoveries, credit and medical data monitoring, plaintiffs’ attorney fees and administration costs. Conduent says the payment is its total monetary obligation under the deal.
The company denies fault, and court approval is still required.
The scale of the exposure is sobering because the compromised data went well beyond a single identifier. An unauthorized third party accessed Conduent’s network from Oct. 21, 2024, to Jan. 13, 2025, and obtained names, addresses, birth dates, medical information, health insurance information and Social Security numbers. In healthcare, that combination creates a durable identity risk profile: once demographic, clinical and payer data are fused, the fallout can include fraud, false claims activity, account takeover and long-tail privacy harm that is difficult to unwind after the fact.
What was exposed and why the breach carries lasting clinical privacy risk
The data set touched core elements of personal and medical identity. Names and addresses can be used to locate and target patients, birth dates help authenticate accounts, and Social Security numbers remain a powerful credential for financial abuse. When medical information and health insurance information are also in the mix, the breach extends into the realm of sensitive health status, billing history and coverage exploitation. The practical consequence is not just exposure of records; it is the possibility that those records can be weaponized against patients in future encounters with payers, pharmacies and care organizations.
The SafePay ransomware group claimed responsibility for stealing 8.5 terabytes of data. Large-scale ransomware incidents often force organizations into a dual crisis: operational disruption on one side and forensic uncertainty on the other. In healthcare-adjacent environments, those two pressures collide because vendors may hold data for multiple clients, and the downstream blast radius can extend from the business services company to the payer or provider organizations that relied on its systems.
Conduent provides front- and back-office services to healthcare clients, including payers, several of which were affected by the incident. The incident was the largest healthcare data breach reported in 2025, according to HIPAA Journal.
How the class settlement divides the affected population
The settlement separates the class into two groups. About 40 million people had data contained in complex backup files, while about 22 million people had data that was readily accessible. Every class member can claim a year of credit monitoring and up to $3,500 for documented losses. The second group can also seek pro rata cash payments, which gives those individuals a path to recover more directly from the fund if claims are approved and distributed as planned.
A distinction like that usually reflects differences in practical harm, not simply in file architecture. Data sitting in backup systems may still be highly sensitive, but readily accessible records can be easier to misuse, copy or operationalize quickly. From a breach-response perspective, those differences shape how plaintiffs are treated in settlement design and how organizations calculate the burden of remediation.
The fund is also supposed to cover attorney fees and administration costs, and plaintiffs’ attorneys are seeking 34% of the fund. If the requested fee share is approved, it will absorb a substantial portion of the total, which is common in large class actions but still relevant for consumers expecting direct restitution. For many affected people, the most immediate benefit may be monitoring rather than cash, because identity misuse after a healthcare breach can emerge months or even years later.
Insurance, client exposure and the next legal step
Conduent says its cyber insurance means it does not expect a material financial impact. Even so, the company’s obligation under the settlement is fixed at the $80 million fund, and the agreement would also release Conduent’s affected clients and those clients’ affected customers from claims tied to the incident if the court approves the arrangement. That release is a major legal feature because it can draw a broad perimeter around future litigation related to the same event.
The settlement still needs judicial approval, and the case remains a reminder of how much healthcare now depends on outside vendors with access to highly sensitive information. Claims processing, back-office administration and payer support may sit outside the exam room, yet they still carry the same privacy expectations patients associate with direct care. When those systems fail, the resulting exposure can be every bit as consequential as a breach inside a hospital network.
The broader clinical takeaway is simple and uncomfortable: healthcare data is not only a compliance asset, it is a patient safety asset in digital form. Once a breach reaches this size, the concern is no longer limited to one company’s security controls. It becomes a question of how many downstream patients must now watch for fraudulent billing, stolen identities and misuse of protected health information in the months ahead.