Conduent Data Breach Settlement: $80 Million Deal Filed for 62 Million Class Members

The Conduent data breach settlement is an $80 million, non-reversionary class deal that Conduent Incorporated disclosed to investors on October 16, 2026, resolving the consolidated litigation in the U.S. District Court for the District of New Jersey over a 2024-2025 intrusion that exposed data on roughly 62 million people. Nothing is payable yet: the agreement must win preliminary and then final approval under Rule 23(e), and because the same $80 million also pays for monitoring, attorneys' fees and administration, the cash that reaches individual claimants will be a fraction of the headline.

The deal resolves In re Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, which is assigned to U.S. District Judge Michael E. Farbiarz, with pretrial matters referred to U.S. Magistrate Judge Michael A. Hammer. Law360 reported the same day that the plaintiffs had asked the court to greenlight the agreement. Below, the terms as disclosed in Conduent's SEC filings, the per-person arithmetic, the approval timeline, the reach of the release, and what the deal means for vendors, health plans and the plaintiffs' bar.

What the Conduent data breach settlement provides

Conduent's Form 8-K, filed under Item 8.01, states that the company "will fund $80 million into a non-reversionary settlement fund" and that the payment is its total monetary obligation under the agreement. The fund is inclusive: it covers recoveries for class members, the cost of credit and medical data monitoring, fees for plaintiffs' counsel, and the costs of administering the settlement. Non-reversionary means no unclaimed money flows back to Conduent; whatever is left after valid claims, fees and costs stays with the class or is redistributed under the agreement's terms.

Three further points from the filing matter to practitioners:

• Release scope. Upon final approval, the agreement releases Conduent, Conduent's affected clients, and those clients' affected customers from claims arising from the incident.
• No admission. The 8-K states the agreement "is not an admission of fault or liability, which the Company denies," and that it remains subject to court approval.
• Insurance. Conduent says it maintains cyber insurance and does not expect the settlement to have a material effect on its financial position, results of operations or cash flows.

The settlement agreement itself, filed with the court and attached to the 8-K, names three Conduent entities as settling defendants: Conduent Business Services, LLC, Conduent State & Local Solutions, Inc., and Conduent Incorporated.

How much is the Conduent data breach settlement?

The Conduent data breach settlement is $80 million, paid into a single common fund. Divided across the approximately 62 million class members identified in the agreement, that is about $1.29 per person before anything is deducted. Measured against the 62,224,658 people listed on the U.S. Department of Health and Human Services breach portal, the figure is the same to the cent.

That per-capita number is low but not out of line with prior mega-breach settlements, where the size of the class drives the per-head figure down regardless of the gross amount.

Settlement	Fund	People affected	Gross per person
Conduent (D.N.J., 2026, pending)	$80 million	~62.2 million	~$1.29
Anthem (N.D. Cal., final approval 2018)	$115 million	~78.8 million	~$1.46
AT&T 1 class (MDL No. 3114, final approval 2026)	$149 million	~73 million	~$2.04
T-Mobile (2021 breach)	$350 million	~76.6 million	~$4.57

The comparison shows Conduent landing at the bottom of the band. Two features of this case help explain why. First, Conduent is a back-office vendor rather than a consumer-facing brand, so plaintiffs faced harder questions on duty, standing and damages for people who never dealt with the company. Second, the settlement was reached early: the parties mediated about 19 months after discovery of the breach, before class certification briefing, before Daubert fights over damages experts, and before any ruling that would have tested the theory of liability on the merits.

Who qualifies for the Conduent data breach settlement?

Anyone in the settlement class qualifies, and the class is built around the roughly 62 million people whose information was in the files taken in the incident. The agreement describes an unauthorized third party that accessed Conduent's networks beginning on or about October 21, 2024 and exfiltrated files; Conduent detected the intrusion on January 13, 2025. Exposed data reportedly included names, addresses, dates of birth, Social Security numbers, health insurance details and medical information.

The agreement excludes Conduent and its officers and directors, the judges assigned to the case and their staff, anyone who opts out, and anyone who has already released claims against Conduent and its clients. That last exclusion matters because some affected people may have resolved claims through separate settlements with Conduent's clients.

Within the class, the agreement creates two subclasses:

• Subclass A members receive one year of credit monitoring automatically, without filing a claim.
• Subclass B members are those whose private information was stored in files where the data was readily accessible. They receive one year of CyEx's Medical Shield product automatically. According to the notice attached to the agreement, Medical Shield includes $1,000,000 in insurance, dark web monitoring, and credit monitoring through one bureau.

The class notice will tell each person which subclass they belong to. People cannot pick their subclass; it turns on what data of theirs sat in which files.

How much will I get from the Conduent settlement?

No per-person cash amount has been set, and none can be until claims are counted. The agreement lets each class member claim up to $3,500 for documented losses tied to fraud or identity theft stemming from the incident. The notice also refers to a separate "California Statutory Cash Payment" for California residents, a feature that typically tracks the statutory damages remedies in California privacy law; the amount was not disclosed in the materials available at publication.

Everything else depends on the claims rate. In the AT&T data breach settlement, about 4.8 percent of class members filed claims. If the Conduent class claimed at that rate, roughly 3 million people would file. Spreading the entire $80 million across 3 million claimants would produce about $27 each, and that is before fees, administration and the cost of a year of monitoring for tens of millions of people are deducted. Claimants with documented, out-of-pocket losses are the ones positioned to recover meaningful money; those without documentation should expect a small payment if the final agreement includes an undocumented cash option, and possibly only the monitoring.

Conduent settlement benefits at a glance

Benefit	Who gets it	Claim required?	Amount or term
Documented-loss reimbursement	Any class member	Yes, with documents	Up to $3,500 for fraud or identity-theft losses
Credit monitoring	Subclass A	No	One year
CyEx Medical Shield	Subclass B (data in readily accessible files)	No	One year; $1M insurance, dark web monitoring, one-bureau credit monitoring
California Statutory Cash Payment	California residents in the class	Yes	Not disclosed at publication
Attorneys' fees, service awards, notice and administration	Paid from the fund	Court must approve	Not disclosed at publication

How do I file a Conduent settlement claim, and is there a deadline?

There is no claim form yet and no deadline yet. The notice attached to the agreement uses placeholder dates, which will be filled in only after the court grants preliminary approval and appoints a claims administrator. Once notice issues, class members must submit a claim to receive any cash payment; monitoring for Subclass A and Subclass B members is provided without a claim.

Because Conduent processed data for state agencies, health plans and employers, scam risk is high. The only legitimate claims portal will be the one named in the court-approved notice. Anyone asked to pay a fee, or to provide a full Social Security number through an unsolicited link, should treat the request as suspect.

Timeline: from intrusion to $80 million

Date	Event
October 21, 2024	Unauthorized access to Conduent's networks begins, per the settlement agreement
January 13, 2025	Conduent detects the incident
February 2025	The SafePay ransomware group publicly claims the attack
Late 2025	Notifications and state filings put the count above 10 million, then above 25 million by February 2026
Late 2025	Court appoints a plaintiffs' steering committee for the consolidated case
Mid-2026	HHS breach portal lists 62,224,658 affected individuals
August 13, 2026	Full-day, in-person mediation in Philadelphia before a JAMS mediator who is a former U.S. magistrate judge; agreement on all material terms
September 10, 2026	Joint status report discloses the agreement in principle; Conduent files an 8-K the same day
October 16, 2026	Settlement agreement filed and disclosed in an 8-K; $80 million fund announced

When will the Conduent settlement be approved and paid?

Approval will take months, and payment comes later still. The path runs through three gates.

Preliminary approval. Under Rule 23(e)(1)(B), Judge Farbiarz must find that he will likely be able to approve the deal under Rule 23(e)(2) and certify the settlement class. Courts in the Third Circuit also look to the factors in Girsh v. Jepson, 521 F.2d 153 (3d Cir. 1975), including the complexity and likely duration of the litigation, the reaction of the class, and the risks of establishing liability and damages. If preliminary approval is granted, the court approves the notice plan and sets deadlines for claims, opt-outs and objections.

CAFA notice. The Class Action Fairness Act requires notice to the appropriate federal and state officials, and 28 U.S.C. § 1715(d) bars final approval until at least 90 days after that notice is served. With dozens of state attorneys general in the picture, that waiting period is a hard floor on the timeline.

Final approval and appeals. After a fairness hearing, the court rules on final approval and on the fee request. Money is distributed only after the settlement's effective date, which ordinarily follows the expiration of any appeal period or the resolution of appeals. In the AT&T data breach settlement, final approval came nearly nine months after the fairness hearing, a reminder that large data breach deals can stall even after the hard work is done. A realistic expectation for Conduent claimants is payment no earlier than late 2027, and later if objectors appeal.

Does the Conduent settlement cover Blue Cross Blue Shield of Texas members?

Yes, if their data was in the affected files, and the release appears to protect the health plan as well. The 8-K states that the release extends to the company's affected clients and those clients' affected customers. Conduent handled back-office processing for health insurers, state Medicaid and benefits programs, and employers, which is why the incident reached so many people who never heard of the company before receiving a breach letter.

Blue Cross Blue Shield of Texas was among the most prominent affected clients; state filings reported about 15.5 million affected Texans, including roughly 4 million BCBSTX members. The client-and-customer release means a class member who stays in the settlement will generally give up claims against the health plan or agency that handed data to Conduent, not just claims against Conduent. Class members who believe they have a stronger claim against a client, for example over a separate notification failure, will need to opt out to preserve it.

Does the settlement end the Texas attorney general investigation?

No. A private class release binds class members, not state enforcement agencies. Texas Attorney General Ken Paxton served civil investigative demands on Conduent and Blue Cross Blue Shield of Texas seeking documents on the breach and on compliance with Texas law, and regulators in Montana and Missouri have reportedly scrutinized the company as well. Those inquiries proceed under state consumer-protection and data-security statutes and can produce civil penalties and injunctive terms regardless of the class deal. The HHS Office for Civil Rights, which administers HIPAA, likewise is not bound by the release.

For Conduent, that means the $80 million is a ceiling on private class exposure, not on total breach exposure. The 8-K's statement that insurance should cover the settlement says nothing about future regulatory penalties.

Why is the Conduent case a class action rather than mass arbitration?

Because the class members never signed a contract with Conduent. Mass arbitration depends on an arbitration clause in a consumer or employment agreement; plaintiffs' firms file thousands of individual demands under that clause and the respondent's own fee schedule creates settlement pressure. Conduent is a business-to-business vendor. The people whose data it processed dealt with their health plan, their state agency or their employer, not with Conduent, so there was no arbitration agreement or class action waiver for Conduent to invoke and nothing to file individual demands under.

That structural fact is why data breach litigation against vendors almost always proceeds as court class actions, often consolidated into an MDL or, as here, a single-district consolidation. It also explains the client release: by paying once, Conduent buys peace for the clients that might otherwise have faced suits from their own members, some of whom may have arbitration clauses in their plan or account terms. Clients whose customer contracts do contain arbitration clauses avoid the risk of a mass arbitration campaign being built off the same breach.

What it means for vendors, health plans and the plaintiffs' bar

For vendors and their defense counsel. The deal is a template for early, global resolution: mediate before class certification, fold the clients and their customers into the release, and fund the settlement through cyber insurance. The low per-capita figure will be cited by future vendor defendants as evidence that $1 to $2 per head is a market rate for intrusions without proof of widespread misuse. Vendors should also expect clients to demand indemnity and release coverage of this kind in their service agreements.

For health plans and agencies that used Conduent. The client release removes much private exposure, but not regulatory exposure, and not claims from class members who opt out. Plans should track the opt-out list once the deadline passes, because opt-outs are the population most likely to sue them directly.

For plaintiffs' firms. The fee award will be argued against a 62-million-member class and an $80 million fund that also buys monitoring. Expect the court to scrutinize how much of the fund's value is attributed to monitoring and to the $1,000,000 insurance feature, since objectors in large breach cases routinely challenge fee requests that count the face value of monitoring products. Firms representing individual clients with documented identity-theft losses well above $3,500 have a decision to make about opting out.

For class members. The practical steps are simple: watch for the court-approved notice, file a claim if you have documented losses or qualify for the California payment, keep receipts for fraud-related costs and time, and do not respond to unsolicited claim solicitations that predate the official notice.

Frequently asked questions

How much is the Conduent data breach settlement?

It is $80 million, paid into a non-reversionary fund that also covers credit and medical data monitoring, plaintiffs' attorneys' fees and administration costs. That is about $1.29 per class member before deductions.

Who qualifies for the Conduent data breach settlement?

The roughly 62 million people whose personal or health information was in files taken from Conduent's networks in the intrusion that began around October 21, 2024. Conduent insiders, the court, opt-outs and people who already released claims are excluded.

How much will I get from the Conduent settlement?

Up to $3,500 if you document fraud or identity-theft losses, plus one year of credit monitoring (Subclass A) or CyEx Medical Shield (Subclass B) without a claim. California residents may also claim a statutory cash payment. Undocumented payouts depend on how many people file.

Is there a Conduent settlement claim form yet?

No. The claim form, the claims deadline and the administrator's website will be released only after the District of New Jersey grants preliminary approval.

When will Conduent settlement payments be sent?

Not before final approval, which cannot come until at least 90 days after CAFA notice and a fairness hearing, and not until any appeals are resolved. Payment before late 2027 is unlikely.

Can I still sue Conduent or my health plan individually?

Only if you opt out by the deadline the court sets. Class members who stay in the settlement release claims against Conduent, its affected clients such as health plans, and those clients' affected customers.