Conduent agrees to $80m settlement over 2024 SafePay-linked breach exposing data of about 62 million people
Conduent has agreed to pay $80m to settle a class action over the October 2024 cyber incident that exposed personal and health data of roughly 62 million people. The filing was submitted to the US District Court for the District of New Jersey on October 16, 2026, and confirmed in an 8-K filing with the SEC. The attack was allegedly carried out by the SafePay ransomware gang, which claimed to have stolen 8.5TB of data. Conduent denies fault or liability, says its cyber insurance should cover the cost, and has agreed to strengthen its data security practices. HIPAA Journal ranks the incident as the third largest healthcare data breach of all time, behind Change Healthcare (over 192 million people) and Anthem (78.8 million).
Technical Details
- The intrusion took place in October 2024 but went undetected by Conduent for almost three months.
- An unauthorized actor exfiltrated data that may include names, addresses, dates of birth, Social Security numbers, health insurance details and medical information.
- The settlement splits claimants into two subclasses: about 40 million people whose data sat in complex backup files that were not readily accessible, and about 22 million whose data was in readily accessible files.
- Only claimants with documented fraud or identity theft losses can receive direct cash reimbursement, capped at $3,500. The fund also covers credit and medical data monitoring and legal fees.
- Conduent supports about 100 million US residents across government health programs, operates many of the largest US toll systems, and handles government payment disbursements.
Remediation
- Conduent has committed to strengthening its data security practices as part of the settlement, which still needs final court approval.
- Affected individuals should use the offered credit and medical data monitoring and watch for identity theft and fraud.
Linha do tempo
-
Conduent agrees to $80m settlement over 2024 SafePay-linked breach exposing data of about 62 million people
ler a análise desta fonte ocultar
Conduent has agreed to pay $80m to settle a class action over the October 2024 cyber incident that exposed personal and health data of roughly 62 million people. The filing was submitted to the US District Court for the District of New Jersey on October 16, 2026, and confirmed in an 8-K filing with the SEC. The attack was allegedly carried out by the SafePay ransomware gang, which claimed to have stolen 8.5TB of data. Conduent denies fault or liability, says its cyber insurance should cover the cost, and has agreed to strengthen its data security practices. HIPAA Journal ranks the incident as the third largest healthcare data breach of all time, behind Change Healthcare (over 192 million people) and Anthem (78.8 million).
Technical Details
- The intrusion took place in October 2024 but went undetected by Conduent for almost three months.
- An unauthorized actor exfiltrated data that may include names, addresses, dates of birth, Social Security numbers, health insurance details and medical information.
- The settlement splits claimants into two subclasses: about 40 million people whose data sat in complex backup files that were not readily accessible, and about 22 million whose data was in readily accessible files.
- Only claimants with documented fraud or identity theft losses can receive direct cash reimbursement, capped at $3,500. The fund also covers credit and medical data monitoring and legal fees.
- Conduent supports about 100 million US residents across government health programs, operates many of the largest US toll systems, and handles government payment disbursements.
Remediation
- Conduent has committed to strengthening its data security practices as part of the settlement, which still needs final court approval.
- Affected individuals should use the offered credit and medical data monitoring and watch for identity theft and fraud.