Exactly two years ago today, on October 21, 2024, an intruder first entered Conduent’s network. Conduent has now agreed to pay $80 million to settle the class-action lawsuit over that breach. That headline number sounds like a major payday for victims. Divide it by the 62.2 million people whose personal and health information was stolen, and it comes to about $1.29 per person. That gap between the headline and the math is the whole story of this settlement.
The agreement was filed in the U.S. District Court for the District of New Jersey on October 16, 2026, and Conduent confirmed it the same day in an 8-K filing with the SEC. It is a proposed settlement, not a final one. The court still has to approve it, and no deadlines for claims, objections, or opting out have been set yet. Anyone telling you to file a claim today, or sending you a link to do it, is jumping ahead of the process.
Where the $80 million actually goes
The $80 million goes into a single non-reversionary fund, and it has to cover everything: payments to class members, credit and medical data monitoring, the plaintiffs’ lawyers, and the cost of running the settlement. The plaintiffs’ attorneys are seeking 34 percent of the fund, which is $27.2 million, leaving $52.8 million before administration costs, service awards, and monitoring are subtracted.
The settlement splits the 62.2 million affected people into two groups. Subclass A, about 40 million people, had data stolen from complex backup files that were hard for an outsider to use. Subclass B, about 22 million people, had data stolen in a readily accessible format. Every class member, in either group, can claim one year of single-bureau credit monitoring valued at $179.40. Every class member can also claim reimbursement for documented, unreimbursed losses caused by the breach, up to $3,500 per person.
One number in this section deserves the same skepticism as the $80 million headline. The $179.40 monitoring figure is a retail sticker price, not what the fund pays. Multiply it by 62.2 million people and you get about $11.2 billion, roughly 140 times the entire settlement fund. The fund cannot pay retail price for everyone, so the monitoring is bought at bulk rates. Its real value to you is the service itself, not $179.40 in cash. The fund also covers medical data monitoring, which watches for misuse of health information, such as fraudulent medical claims filed in your name. It is separate from credit monitoring, which watches for new financial accounts.
Only Subclass B members can claim an additional cash payment, and that payment is pro rata, meaning it depends on what is left after fees, administration, service awards, monitoring, and loss claims are paid. Class representatives receive $1,500 each. California residents at the time of the breach get their pro rata payment plus 20 percent extra. The arithmetic leaves a plain conclusion: unless you suffered documented losses, the real value here is the free monitoring and a small cash sum, not a windfall. The $3,500 documented-loss claim is the only part of this settlement that carries serious money for an individual, so receipts and records matter more than headlines.
That per-person figure needs a correction in the other direction, too. The $1.29 assumes all 62.2 million people split the whole fund equally, but cash payments go only to Subclass B members who actually file a claim. An FTC study of 149 consumer class actions found a median claims rate of 9 percent and a weighted mean of 4 percent. If only a fraction of Subclass B files, those who do will split a larger per-person share than $1.29. How much larger cannot be known until fees, monitoring, and loss claims are paid and claims are counted.
A three-month intrusion nobody noticed
Conduent’s own forensic investigation found that an unauthorized third party first breached its network on October 21, 2024, and kept access until January 13, 2025. That is nearly three months inside the network before detection. The stolen data included names, addresses, dates of birth, Social Security numbers, medical information, and health insurance information. The SafePay ransomware group claimed to have taken 8.5 terabytes of data, but that figure is the gang’s own claim, not something Conduent has independently verified.
The scale puts this breach third among healthcare breaches of all time, behind the 2024 Change Healthcare incident and the 2015 Anthem breach, and it was the largest healthcare breach reported in 2025. Conduent runs back-office services for government health programs and toll systems, which is why so many ordinary people are in this class without ever having heard of the company. If you used a state Medicaid program, a government health service, or a toll system Conduent processed, your data may be in this breach even if the Conduent name means nothing to you. Conduent denies fault and says the agreement is not an admission of liability. It also says it holds cyber insurance and does not expect the settlement to materially affect its finances. The contrast is sharp: the company’s downside is insured, while victims divide a fixed fund.
Did you get a letter in 2025?
Conduent began mailing breach notification letters in October 2025, about nine months after the intrusion ended. Those letters offered free identity monitoring, with terms varying by program: some offered one year, some two. Many recipients mistook the letter for a scam, because they had never heard of Conduent. If you threw it away, the settlement notice, once the court approves it, is a second chance to claim benefits. If you enrolled in monitoring from the 2025 letter, check whether it is still active before claiming the settlement’s monitoring, since the two may overlap rather than stack. Not receiving a letter does not prove you were unaffected: the victim count grew as the investigation continued, and Conduent’s clients, not Conduent itself, held the relationship with most victims.
What to do if your data was in it
Nothing can be claimed yet, because the court has not approved the settlement or set dates. The useful work happens now, before any notice arrives.
- Place a free credit freeze with Equifax, Experian, and TransUnion, since stolen Social Security numbers stay usable for years.
- Gather receipts, bank statements, and fraud reports for any loss tied to this breach, up to the $3,500 documented-loss limit.
- Ignore emails or texts claiming to be settlement links, and wait for the official court-approved claim notice instead.
- Check whether your health plan used Conduent: breach notices name Blue Cross Blue Shield of Texas, Premera, and Anthem plans.
- Claim the settlement’s free year of credit monitoring once it opens, unless monitoring from your 2025 letter is still active.
- Watch for the California extra payment if you lived in California when the breach happened, since it adds 20 percent.
A credit freeze is the single strongest step here, because it blocks new accounts in your name regardless of what happens with the settlement. Placing and lifting a freeze costs nothing under federal law. Our guide to what to do when personal information leaks walks through the freeze process, and our Social Security number guide covers the extra steps when an SSN is involved, including IRS and SSA protections.
The decision the settlement does not advertise: opting out
Staying in the settlement caps your documented-loss recovery at $3,500. If your losses from this breach exceed that amount, opting out may be the better option, because it preserves your right to sue Conduent individually for the full amount. The trade is real: opting out means giving up the settlement’s monitoring and any cash payment from this fund, and an individual lawsuit costs time and money with no guaranteed outcome. No opt-out deadline exists yet, since the court has not approved the settlement. When dates are set, compare your documented losses against the $3,500 cap before deciding. This article is not legal advice. For an opt-out decision involving large losses, consider speaking to an attorney.
What is not decided yet
Three things remain open, and each one changes what victims should expect. First, court approval is pending, so the settlement terms could still change before anything is final. Second, no claim, objection, or exclusion deadlines exist yet, so any message giving you a deadline right now is not from the official process. Third, the size of the Subclass B cash payment cannot be known until the fund pays out fees, monitoring, administration, and documented-loss claims first. Anyone quoting you a per-person payout figure today is guessing.
We are tracking this case in our Data Breach Tracker, and we will update this article when the court approves the settlement and claim dates are set. Until then, the honest summary is this: $80 million is a large settlement and a small recovery at the same time. The monitoring is real, the documented-loss claims are real, and the cash payment for most people will be small. The people who come out best from this settlement will be the ones who kept their receipts.
Sources: HIPAA Journal, October 20, 2026; SC Media, October 20, 2026; Infosecurity Magazine; Conduent Form 8-K filed with the SEC, October 16, 2026; U.S. District Court for the District of New Jersey, In Re Conduent Business Services Data Breach Litigation.
