Privacy
Conduent to pay $80m after healthcare data breach hits 62 million
Conduent will pay $80 million to settle a class action over a 2024 data breach that exposed the health data of 62 million people. The company also agreed to improve its security.
Ross GrantUpdated 2 min read
The short version
Conduent, a company that handles data for US health programmes, suffered a cyberattack in 2024 that exposed the personal and health information of 62 million people. The company has now agreed to pay $80 million to settle a lawsuit from those affected. The stolen data included sensitive details like names, Social Security numbers and medical information. Conduent will also strengthen its security to prevent future breaches.
By the numbers
- 62 millionpeople affected by the breachInfosecurity Magazine
- $80 millionsettlement amount agreed by ConduentInfosecurity Magazine
- $3,500maximum direct cash reimbursement per claimant with documented lossesInfosecurity Magazine
- 8.5TBdata allegedly stolen by SafePay ransomware groupInfosecurity Magazine
What happened?
Conduent has agreed to pay $80 million to settle a class action lawsuit after a 2024 cyber incident exposed the health data of about 62 million people. The breach, allegedly carried out by the SafePay ransomware group, is the third largest healthcare data breach ever recorded. The settlement includes compensation for affected individuals and a commitment to improve security. Conduent denies any admission of fault.
Who is affected
The 2024 cyber incident at Conduent compromised the personal and health data of about 62 million people, according to Infosecurity Magazine (opens in a new tab). The company provides back-office and payment services for US government health programmes and supports around 100 million US residents. The breach is ranked as the third largest healthcare data breach ever recorded, behind the Change Healthcare and Anthem incidents.
What was taken
Conduent told affected individuals that an unauthorised actor exfiltrated data, which may have included names, addresses, dates of birth, Social Security numbers, health insurance details and medical information. The stolen data was split into two groups: about 40 million people had data stored in complex backup files that were not easily accessible to outsiders, while 22 million had data in files that were more readily accessible.
The response
Conduent agreed to pay $80 million to settle a class action lawsuit brought by people affected by the breach. The settlement, confirmed in a US Securities and Exchange Commission (SEC) filing, will cover material losses, credit monitoring and medical data monitoring for claimants, and legal fees. Only those who can prove losses from fraud or identity theft linked to the breach can claim direct cash reimbursement, up to $3,500 each. The agreement also requires Conduent to strengthen its data security practices. The company maintains cyber insurance and said it does not expect the settlement to have a material impact on its finances. Conduent denies any admission of fault or liability.
How the attack worked
The SafePay ransomware group claimed responsibility for the attack, saying it stole 8.5TB of data from Conduent. The breach occurred in October 2024 but was not discovered by the company for nearly three months. Conduent has not said exactly how the attackers got in, but ransomware attacks often involve gaining access through phishing emails, exploiting software vulnerabilities, or using stolen credentials.
Has this happened before?
As of October 2026, this incident is the third largest healthcare data breach on record. The largest remains the 2024 Change Healthcare ransomware attack, which affected over 192 million people, followed by the 2015 Anthem breach, which impacted 78.8 million people.
Claimed vs confirmed
- Unconfirmed
SafePay ransomware group stole 8.5TB of data from Conduent.
SafePay claimed responsibility, but Conduent has not confirmed this detail.
Why it matters
This breach affected a huge number of people and exposed sensitive health and personal data, increasing the risk of fraud and identity theft. It also shows the scale of impact when service providers for government programmes are targeted. The settlement is a reminder that organisations can face major legal and financial consequences after large data breaches.
Key points
- Conduent will pay $80 million to settle a lawsuit over a 2024 data breach.
- The breach exposed health and personal data of about 62 million people.
- Only claimants with documented losses can claim up to $3,500 each.
- Conduent will improve its data security as part of the settlement.
- The attack is the third largest healthcare data breach ever recorded.
Sources
Infosecurity Magazine
Reference
- Conduent Agrees to Pay $80m to Settle Data Breach Class Action (opens in a new tab)
infosecurity-magazine.com
- Conduent Agrees to Pay $80m to Settle Data Breach Class Action (opens in a new tab)
