Conduent has agreed to pay $80M to close class litigation over an October 2024 intrusion that exposed the personal and health information of roughly 62 million people, Infosecurity Magazine reported Monday.
The October 16 filing in the District of New Jersey splits claimants into two groups: about 40 million whose records sat in complicated backup files that outsiders could not easily open, and 22 million whose data was readily readable. Only those with documented fraud or identity theft losses qualify for cash reimbursement, capped at $3,500. Credit and medical data monitoring are included, and the benefits processor also committed to security improvements. Conduent disclosed the deal in an SEC filing and denies liability.
The SafePay group claimed credit for the hack, saying it took 8.5TB. Conduent reportedly did not detect the activity for nearly three months, and notifications later covered names, birth dates, Social Security numbers, insurance details and medical information. On protected health data volume, the incident ranks third in the US, behind the 2024 Change Healthcare ransomware attack at more than 192 million and Anthem’s 2015 breach at 78.8 million.
Conduent handles printing, mailroom, document processing and payment integrity work for government health programs covering roughly 100 million US residents, which is why a single vendor compromise reached so far into clinical data. Final court approval is still pending.
