By Hamza Faisal
Conduent, the back-office processor that handles data for some of America's largest health insurers and government agencies, has agreed to pay $80 million to settle the sprawling class-action lawsuit that followed one of the largest healthcare data breaches in United States history.
The company disclosed the deal in a filing with the Securities and Exchange Commission on October 16. Conduent Incorporated, Conduent Business Services LLC, and Conduent State & Local Solutions entered a Class Action Settlement Agreement and Release with the plaintiffs in the consolidated lawsuit pending in the U.S. District Court for the District of New Jersey.
Three months inside the network
The breach itself began in October 2024. Attackers held access to Conduent Business Services' systems until January 13, 2025 — nearly three months — before the intrusion was discovered and stopped. Conduent, spun off from Xerox in 2017, provides mailroom, payment processing, and back-office support services that touch more than 100 million Americans, through clients including several major Blue Cross Blue Shield entities and Premera Blue Cross.
When the theft was finally tallied, the damage was enormous. The company now puts the number of affected individuals at more than 62 million. Names, addresses, dates of birth, Social Security numbers, and clinical data were taken — the kind of identifiers that cannot be canceled and reissued like a credit card, and that can fuel identity theft, medical fraud, and targeted scams for years.
The Texas Attorney General called it "likely the largest breach in U.S. history," while HIPAA Journal ranked it the eighth-largest healthcare data breach ever recorded. More than 35 class-action lawsuits were filed before being consolidated into a single case: In re: Conduent Business Services Data Breach Litigation.
What the $80 million covers
Under the agreement, Conduent will fund $80 million into a non-reversionary settlement fund, which represents the company's total monetary obligation. The fund covers recoveries for class members, credit and medical data monitoring, plaintiffs' counsel fees, and the costs of administering the settlement.
Upon final approval, the deal releases Conduent, its affected clients, and those clients' affected customers from claims arising from the incident. The agreement remains subject to court approval, and Conduent denies any admission of fault or liability.
The company said it maintains cyber insurance and does not expect the settlement to have a material impact on its financial position, results of operations, or cash flows — suggesting a significant share of the $80 million may be recoverable through insurance.
A long road still ahead
The settlement does not end the story. It took Conduent nearly ten months to notify most affected people — notification letters were not sent until October 2025 — and the court must still give final approval before any money flows.
Regulators and clients will be watching whether the back-office vendor that quietly sat between insurers and tens of millions of members can convince the market it has closed the gaps the attackers walked through. For the 62 million people whose records were exposed, the payout marks an end to the litigation — not to the risk. The data stolen in those three months does not expire.
By Hamza Faisal
