# Conduent Agrees to Pay $80 Million to Settle 62 Million-Person Breach

- URL: https://usa-24.com/conduent-settlement-payout-eligibility/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-23T16:49:53.945Z
- Updated: 2026-10-23T16:49:53.951Z
- Topics: Data Breaches, Class Action Lawsuits, Healthcare Data Security, Cybersecurity Litigation

> Conduent agreed to pay $80 million to settle a class action over a breach that exposed data on about 62 million Americans. Court approval is still pending, and only documented losses qualify for direct cash.

## Key takeaways

- Conduent agreed to pay $80 million, a non-reversionary fund, to resolve a consolidated class action over a breach affecting about 62 million people.
- The settlement is not final until the U.S. District Court for the District of New Jersey approves it, and no hearing date has been reported.
- Only people with documented fraud or identity-theft losses can receive direct cash, capped at $3,500 per claimant.
- The class splits into subclasses of roughly 40 million and 22 million people, depending on how their data was stored.
- Conduent denies wrongdoing and says it expects no material effect on its finances, operations or cash flows.

Conduent agreed to pay $80 million to settle a consolidated class action over a data breach that exposed personal and protected health information belonging to about 62 million Americans. The settlement was signed October 16, 2026, and the company disclosed it in a [Form 8-K filed with the Securities and Exchange Commission](https://www.sec.gov/Archives/edgar/data/0001677703/000167770326000138/doc173-2xsettlementagree.htm). No one can collect yet, because a federal judge still has to approve the deal.

The case is captioned In re: Conduent Business Services Data Breach Litigation, Case No. 2:25-cv-16953, before Judge Michael E. Farbiarz in the U.S. District Court for the District of New Jersey. Conduent, a business-services provider, denies any wrongdoing or liability. [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/conduent-settle-data-breach-action/) and [Becker's Hospital Review](https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/conduent-to-pay-80m-to-settle-3rd-largest-healthcare-data-breach/) both reported the deal, and Becker's frames the breach as the third-largest healthcare data breach.

For the roughly 62 million people in the class, the practical questions are simple: Is there money, and how much? The answers depend on the kind of loss you can document, and the sources do not yet say when claims open.

## What the Conduent settlement covers from its $80 million fund

The $80 million is a non-reversionary fund, which Conduent describes as its total monetary obligation. The money pays class payments, credit and medical monitoring, attorney fees and administration costs. In a non-reversionary structure, money that goes unclaimed generally does not return to the defendant, although the sources do not say how unclaimed money would be handled in this case.

Attorney fees and administration come out of the same pool. That means the amount available to claimants will be smaller than $80 million, and the headline figure should be read as a ceiling for the whole settlement, not a check for each person.

## Who can get direct cash and who gets monitoring

Direct cash is narrow. Only people with documented losses from fraud or identity theft can receive direct reimbursement, capped at $3,500 per claimant. Someone whose data was exposed but who has no documented loss would not qualify for that cash. Becker's and Kalkine both describe credit and medical monitoring as part of the fund, so monitoring-type benefits are the broader offer.

Documentation is the real hurdle. Start collecting bank statements that show unauthorized charges, letters from creditors, police reports and any notice that a new account was opened in your name. The sources do not list what the claim form will require, so treat that list as a starting point rather than a checklist.

## Why the 40 million and 22 million subclasses matter

The class splits into two subclasses. About 40 million people had data in backup files that were harder to access, and about 22 million had data in more readily accessible files. The division follows where the records were stored, not a finding about how each person was harmed.

The two groups add up to roughly the 62 million figure that appears across coverage. The sources do not confirm whether 62.2 million is the final count of notified individuals, so that number may change as notices go out. The sources also do not say whether the split changes what each group can claim, so avoid assuming your share depends on it until the settlement papers are public.

## Breach timeline and why reports disagree on the year

HIPAA Journal's account of the case gives a clear window for the intrusion:

| Date | What happened |
|---|---|
| October 21, 2024 | Unauthorized access begins |
| January 13, 2025 | Unauthorized access ends |
| October 16, 2026 | Settlement signed and disclosed in an 8-K filing |

That timeline explains why the incident gets labeled two ways. Some outlets call it a 2024 event, while Kalkine's headline calls it a 2025 breach. The intrusion started in late 2024 and access continued into January 2025, so both labels describe the same incident.

HIPAA Journal ranks the breach as the largest healthcare data breach reported in 2025 and the third-largest healthcare breach of all time. The lawsuit's case number, 2:25-cv, indicates it was filed in 2025, and the settlement arrived more than a year and a half after access ended. For scale, KOLD reported this month that a cyberattack on Arizona courts stole data on more than 1 million people, which places the Conduent case in a wider run of large data thefts.

## What the settlement means for Conduent and its clients

Conduent says it carries cyber insurance and expects no material effect on its finances, operations or cash flows. GuruFocus argues the settlement removes a major legal overhang, even though the company still faces financial strain. Both views can be true. An insured settlement can close a lawsuit without changing the company's near-term outlook, while the reputational cost of a breach this size can linger.

If the court approves the deal, Conduent would be released from civil claims over the incident. Kalkine reports that the release also covers Conduent's clients and their customers, which makes the approval important to health organizations that rely on the company's services. The settlement also requires Conduent to strengthen its data security practices, but the sources do not list those commitments.

Conduent denies liability, so the allegations have never been tested in court. The settlement avoids a trial that could have produced findings about how the breach happened. For other vendors that handle health data, the message is that large class settlements are a real cost, even for a company that carries insurance. USA 24 has also covered another healthcare disclosure, in which [Quest Diagnostics said an unauthorized party accessed patient records](https://usa-24.com/quest-diagnostics-data-breach-patient-records/).

## Steps to take while the settlement awaits approval

1. Save evidence of any fraud or identity-theft loss now. Only documented losses qualify for direct cash, so keep bank statements, card dispute correspondence, police reports and creditor letters in one folder.
2. Watch for the official settlement website after the court acts. The sources do not yet give a claim deadline. Be cautious with unsolicited emails or calls offering to file claims for you.
3. Freeze your credit. Equifax, Experian and TransUnion each offer free freezes, which keep most lenders from pulling your report to open new accounts. You can lift a freeze when you need credit.
4. Check your credit reports at AnnualCreditReport.com, the free federal site, and look for accounts you do not recognize.
5. For a general response plan after a breach, read USA 24's guide: [Capcom breach: what to do](https://usa-24.com/capcom-data-breach-what-to-do/).

## What to watch before claims open

Settlements like this usually move through preliminary approval, notice to class members and a final approval hearing before any payouts begin. The sources do not give dates for those steps, so watch the docket for Case No. 2:25-cv-16953 and Conduent's SEC filings for updates.

Three questions will shape what the $80 million means in practice. First, whether 62.2 million becomes the final count of notified people. Second, how much attorney fees and administration costs reduce the amount available to claimants. Third, what specific security improvements the settlement requires Conduent to make. The judge's decision on approval is the next real signal, and the answers to those questions will show whether the fund reaches the people who lost the most.

## Frequently asked questions

### Am I eligible for the Conduent settlement?

The settlement covers a class of about 62 million people whose data was affected in the breach. Direct cash is limited to people with documented losses from fraud or identity theft, while credit and medical monitoring are part of the fund. The settlement still needs court approval, and the sources do not list final eligibility rules.

### How much money can I get from the Conduent settlement?

Direct cash reimbursement is capped at $3,500 per claimant and applies only to documented fraud or identity-theft losses. The $80 million fund also pays monitoring, attorney fees and administration costs, so the amount left for claimants will be smaller than $80 million. The sources do not estimate typical individual payouts.

### When is the Conduent settlement claim deadline?

No claim deadline or final hearing date appeared in the sources reviewed. The settlement was signed October 16, 2026, and it remains subject to approval in the U.S. District Court for the District of New Jersey. Watch for an official settlement website once the court acts.

### Did the Conduent breach happen in 2024 or 2025?

It happened across both years. According to HIPAA Journal, unauthorized access ran from October 21, 2024, until January 13, 2025. Some coverage calls it a 2024 event, while other outlets, including Kalkine, call it a 2025 breach.

## Sources

1. [Conduent Agrees to Pay $80m to Settle Data Breach Class Action](https://www.infosecurity-magazine.com/news/conduent-settle-data-breach-action/)
2. [Conduent to pay $80M to settle 3rd-largest healthcare data breach](https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/conduent-to-pay-80m-to-settle-3rd-largest-healthcare-data-breach/)
3. [$80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation](https://www.hipaajournal.com/conduent-business-services-data-breach-settlement/)
4. [Conduent Inc., Form 8-K (FY2026) settlement notice, SEC EDGAR](https://www.sec.gov/Archives/edgar/data/0001677703/000167770326000138/doc173-2xsettlementagree.htm)
5. [Conduent Agrees to $80 Million Class Action Settlement Over 2025 Data Breach](https://kalkinemedia.com/us/news/announcements/conduent-agrees-to-80-million-class-action-settlement-over-2025-data-breach)
6. [Arizona courts breached by cyberattack, data stolen for more than 1 million people](https://www.kold.com/2026/10/08/arizona-courts-breached-by-cyberattack-data-stolen-more-than-1-million-people/)
7. [Conduent (CNDT) Settles Cybersecurity Breach Lawsuit with $80M Fund](https://www.gurufocus.com/news/9128461/conduent-cndt-settles-cybersecurity-breach-lawsuit-with-80m-fund)