Conduent to Pay $80 Million in Settlement Over Massive 2024 Healthcare Data Breach

Conduent, a provider of business process services, has agreed to an $80 million settlement to resolve a class‑action lawsuit stemming from a 2024 cyber‑attack that exposed the personal health information of roughly 62 million individuals.

The breach, which security analysts say was discovered in early 2024, involved unauthorized access to a database containing names, dates of birth, social‑security numbers and medical‑record details. Investigators linked the intrusion to a sophisticated hacking group that exploited a vulnerability in Conduent's cloud‑based platform used by health‑care clients.

Following the disclosure, a coalition of plaintiffs filed a class‑action suit alleging that Conduent failed to implement adequate safeguards and to notify affected consumers in a timely manner, in violation of federal privacy statutes and state data‑protection laws. The suit represented a cross‑section of consumers across multiple states, all claiming potential harm from identity‑theft and privacy violations.

Under the terms of the settlement, Conduent will allocate the $80 million into a compensation fund that will be distributed to class members based on the sensitivity of the data exposed and the length of exposure. In addition to monetary relief, the agreement includes provisions for free credit‑monitoring services and identity‑theft protection for a period of two years for affected individuals.

Conduent, which offers a range of outsourced services ranging from health‑care claims processing to government benefits administration, has faced scrutiny over its cybersecurity posture in recent years. While the company has not disclosed any prior incidents of comparable scale, industry observers note that the firm’s rapid expansion into digital health platforms may have outpaced its security investments.

The settlement arrives amid growing regulatory focus on the protection of health‑care data, especially as the sector continues to digitize patient records. The U.S. Department of Health and Human Services has signaled heightened enforcement of HIPAA rules, and several states are considering stricter data‑breach notification statutes.

Conduent will now work with a court‑appointed administrator to process claims and distribute funds. The company also pledged to enhance its security framework, including third‑party audits and accelerated patch‑management processes, to prevent future incidents. Affected consumers are advised to monitor the settlement website for eligibility details and to take advantage of the offered credit‑monitoring services while remaining vigilant against potential fraud.