Conduent Data Breach Settlement: $80 Million Fund for 62 Million People

Conduent agreed to pay $80 million to settle a class action over its January 2025 cyberattack, a case that plaintiffs say reaches about 62 million people. The agreement was disclosed in a Form 8-K filed with the SEC on Friday, October 16, 2026, and it cannot take effect until a federal judge in New Jersey approves it.

That figure is far larger than the first disclosures suggested. Conduent is a business-process and government services contractor, so many of the people whose data was exposed never gave their information to the company directly. Their records sat in systems Conduent ran for clients, including state programs, which is why the fallout reached people who had never heard of the company.

What the $80 million fund would pay for

The fund is non-reversionary, meaning the money stays in the settlement rather than returning to Conduent, according to Bank Info Security's coverage. It would cover class payments, credit and medical monitoring, attorney fees and administration costs.

Plaintiff lawyers are asking for up to 34% of the fund, or about $27.2 million, in fees. That request will shape how much reaches victims, so it is the first number to watch when the court reviews the deal.

Once approved, the settlement would release Conduent, its clients and their affected customers from claims tied to the incident, Kalkine Media reported. Conduent denies wrongdoing. Its Form 8-K says the settlement "is not an admission of fault or liability, which the Company denies," as Kalkine Media quoted it. The company also says it carries cyber insurance and expects no material effect on its finances, according to Webull's report.

The release language deserves a careful read. In most class settlements, joining the class means giving up the right to bring your own lawsuit over the same incident, so check any notice closely before you file a separate claim.

How the attack unfolded and what was taken

According to Security Affairs, the intrusion began with access on October 21, 2024, and Conduent did not detect it until January 13, 2025. That gap of nearly three months is the detail to remember for anyone asking how long their data was exposed.

Conduent's 10-Q for the quarter ended September 30, 2025 described a January 13, 2025 "cyber event" that forced operational disruption and led to the exfiltration of files tied to some clients.

Plaintiffs allege that the SafePay ransomware group took about 8.5 terabytes of data, including Social Security numbers, health insurance details and medical information. Summaries by Mallory and ClaimDepot report those allegations. SafePay has also been linked to other healthcare attacks in the same period, Bank Info Security reported.

The data types matter. Social Security numbers and medical details are hard to change, which is why credit monitoring and fraud protection sit at the center of this deal.

The disruption also reached government clients. Early 2025 disclosures showed state agencies reporting service and payment outages during the attack, and Wisconsin and Oklahoma were named.

Why the victim count keeps climbing

Each new filing has raised the number, and the figures do not line up neatly. The first state-level tally, which appeared in Oregon's breach notice, listed 10,515,849 individuals, with Texas at about 4 million. Later, an updated Texas filing put Texans at 15.4 million. TechCrunch reported more than 25 million people as confirmed victims, a figure cited by SC Media. The settlement filing now describes about 62.2 million class members.

The available reporting does not explain how the count moved from about 10.5 million to 62.2 million. Treat the settlement figure as the filing's number, not a final headcount.

Am I affected by the Conduent breach

The class is defined by data, not by whether you were a Conduent customer. People whose Social Security numbers, health details or insurance information sat in files Conduent held may be class members. The court and final settlement terms will set the definition, and the reporting does not say whether every client's end users are covered or only a subset.

Some people first learned about the breach from their employers. SecurityWeek reported employee notices from the Volvo Group that reached workers through their employers, which shows how a vendor breach can travel through a job.

Not having a letter does not rule you out, because the class definition is still being set. If you did receive a notice from Conduent or one of its clients, that letter is the best evidence that your data was involved.

USA 24 has reported on a similar pattern in its coverage of the Senture cyberattack that knocked out the FMCSA trucker phone help line, where a contractor outage hit a federal service the public relies on. Readers still waiting on notices from another large incident can compare timelines in USA 24's CenterPoint Energy breach coverage.

What to do now

These steps do not require waiting for the court.

• Check mail and email for a breach notice from Conduent, a client, an employer or a state agency. Keep the letter and any reference number it includes.
• Enroll in any credit or medical monitoring before its deadline. The claims process has not opened, so watch for official notices from the settlement administrator.
• Place a free fraud alert or a security freeze with Equifax, Experian and TransUnion, especially if your Social Security number may have been involved.
• Review Medicare, Medicaid and health insurance statements for services you did not receive.
• Ignore unsolicited emails, texts and calls offering settlement payouts. No payment process has been approved.
• Check the docket for case No. 2:25-cv-16953 in the U.S. District Court for the District of New Jersey for approval orders and official claim forms.

What happens next in New Jersey

The next step is a ruling in the District of New Jersey, where Judge Michael E. Farbiarz is presiding over the consolidated case. The reporting does not confirm a hearing date, claims deadline or payout schedule.

Conduent's SEC filings said notifications were expected to finish by early 2026, months before this settlement. Many people may already have received letters, but anyone who did not should contact the company or the client that held their data.

Two disputes remain open. Sources disagree on the year, and Bank Info Security's headline calls it a 2024 hack even though discovery came in January 2025. Conduent also says it has found no evidence that its data has appeared on the dark web, while SafePay has claimed the attack. The reporting does not resolve either point.

The real test comes when the court sets a claims process. Watch for a preliminary approval order, a notice plan and a claims deadline, and check whether the fee request changes. Those documents will show affected Americans what they can actually collect, and when.