Cigna Lawsuit: The Data Breach Case, the Conduent Deal and What Is Still Missing
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Most people searching for a Cigna lawsuit got a letter about the Cigna data breach. That breach happened at a vendor, Conduent Business Services, between October 21, 2024 and January 13, 2025. Cigna was sued directly in Connecticut and is also a named defendant in the consolidated Conduent case in New Jersey, where Conduent disclosed an agreement in principle to settle on September 10, 2026. As of October 12, 2026 there is no approved Cigna settlement, no amount and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Data Breach Lawsuits Say Happened
Cigna used an outside vendor for its Payment Integrity work — the back-office process that checks claims for overpayments. That vendor has been publicly identified as Conduent Business Services. An intruder had access to Conduent's network from October 21, 2024 until Conduent identified the breach on January 13, 2025.
According to a Cigna notice letter as reported by secondary sources, Cigna learned of the incident on January 15, 2025, but the vendor did not confirm that Cigna data was involved until September 3, 2025. The data named in the Cigna lawsuit includes names, health care IDs, dates of service, treatment costs and claim numbers; in some cases Social Security numbers were also involved. Not every Cigna customer was affected.
The lawsuit alleges Cigna failed to use reasonable security and took too long to notify people. Cigna has not conceded any of this, and Conduent says it denies the plaintiffs' allegations.
Case Details
There are two separate data breach tracks, and Cigna sits in both:
1. Lopez v. The Cigna Group Inc. — filed December 17, 2025 in the U.S. District Court for the District of Connecticut, reported as Case No. 2:25-cv-02113. It names Cigna as the defendant and pleads negligence, negligence per se, breach of implied contract, unjust enrichment and injunctive relief on behalf of a proposed nationwide class.
2. In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, U.S. District Court for the District of New Jersey, before Judge Michael E. Farbiarz with Magistrate Judge Michael A. Hammer. A consolidated complaint uniting 35 suits was filed on March 18, 2026; it names The Cigna Group as a defendant alongside Conduent and other insurers including Elevance Health, Humana and Blue Shield of California. Full detail is on our Conduent data breach settlement page.
Status: A Deal in Principle, No Cigna Settlement Yet
In a Form 8-K filed September 10, 2026, Conduent told the SEC it reached “an agreement in principle to settle the consolidated case” in August 2026, and that “the settlement agreement has not yet been approved by the court.” On September 11 the New Jersey case was stayed. The filing names no dollar amount, and it does not say whether Cigna and the other insurer defendants are part of the deal. The docket shows further entries on October 9, 2026, including a protective order.
For the Connecticut case against Cigna alone, the latest status we could confirm is that it was in early stages as of February 19, 2026. We checked again on October 12, 2026 and found no later update. We could not verify whether it has since been moved or combined with the New Jersey case.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected by the Cigna Data Breach
The people at issue are Cigna plan members whose claims passed through the vendor's Payment Integrity files. Conduent's breach overall affected at least 62,224,658 people across many clients, per its filing with federal health regulators. How many of those are Cigna members has not been published.
The practical test is your letter. Notices about the Conduent incident began going out on October 24, 2025. A Cigna letter about a vendor “Payment Integrity” incident is the one that matters here. Keep it — it lists your exposed data and will help show you are a class member if a settlement is approved. You do not need to sign up anywhere to be included in a class.
Is There a Cigna Settlement Payment?
For context only, not a prediction: healthcare breach settlements usually combine reimbursement for documented losses, a small flat payment and credit monitoring. With a class in the tens of millions, the per-person flat payment tends to be small, so receipts for real losses matter. Our data breach settlement calculator shows typical ranges.
Do not confuse this with the separate $1.07 million Cigna settlement over out-of-network providers misclassified as in-network. That case has nothing to do with the breach.
Cigna Data Breach Timeline
- 1
October 21, 2024 — Intruder Gets In
An unauthorized party gains access to the network of Conduent Business Services, a vendor that handled Payment Integrity work for Cigna.
- 2
January 13–15, 2025 — Breach Found
Conduent identifies the breach on January 13. According to Cigna's letter as reported, Cigna learns of it on January 15, 2025.
- 3
September 3, 2025 — Cigna Data Confirmed
Per the reported letter, the vendor confirms Cigna member data was involved. Conduent notices start going out October 24, 2025.
- 4
December 17, 2025 — Cigna Sued in Connecticut
Lopez v. The Cigna Group Inc. is filed in the District of Connecticut, alleging weak security and slow notice.
- 5
March 18, 2026 — Cigna Named in Conduent Case
The consolidated complaint in New Jersey (No. 2:25-cv-16953) unites 35 suits and names The Cigna Group as a defendant.
- 6
September 10–11, 2026 — Deal in Principle, Case Stayed
Conduent discloses an agreement in principle with no amount; the court stays the case. As of October 12, 2026, no claim form exists.
Three Things to Watch For
A breach letter from a big insurer plus headlines about a “settlement” with no claim form is exactly what scammers exploit:
“File your Cigna settlement claim” sites
No court has approved a Cigna or Conduent settlement, so no official claim site exists yet. A page asking for your Social Security number or Cigna member ID to “reserve your payment” is collecting data, not filing anything.
Calls quoting your claim numbers
The stolen files included claim numbers, dates of service and treatment costs — exactly the details a caller can use to sound like Cigna. Hang up and call the number on your Cigna card instead.
The unrelated out-of-network settlement recycled
Messages pointing to the $1.07 million Cigna out-of-network settlement as “the breach payout” mix up two unrelated cases. That settlement has nothing to do with your data.
Cigna Lawsuit — Questions People Actually Ask
Is there a class action lawsuit against Cigna?
Yes, several. For data, there is Lopez v. The Cigna Group Inc. in Connecticut and the consolidated Conduent case in New Jersey, which names Cigna. Separately, Kisting-Leung v. Cigna (No. 2:23-cv-01477, Eastern District of California, filed July 24, 2023) challenges claim denials made using an algorithm, and a Pennsylvania federal judge on July 27, 2026 let plan members pursue most claims over an Adobe tracking pixel.
Is there a Cigna data breach settlement?
Not an approved one. Conduent disclosed an agreement in principle on September 10, 2026, but it has no published amount, has not been approved by the court, and does not say whether Cigna is covered. As of October 12, 2026 there is no claim form and no deadline.
Was the Cigna data breach a hack of Cigna itself?
No. The access happened at a vendor that handled Cigna's Payment Integrity work, publicly identified as Conduent Business Services, from October 21, 2024 to January 13, 2025. Cigna is sued because it was responsible for its members' data.
What data was exposed?
The Cigna lawsuit lists names, health care IDs, dates of service, treatment costs and claim numbers. In some cases Social Security numbers were also involved. Your own letter says which fields applied to you.
Is Evernorth Behavioral Health the same as Cigna?
Evernorth is part of The Cigna Group. Cigna's quarterly SEC filing lists Evernorth Health Services and Cigna Healthcare as its two main business segments. The data breach cases on this page are about Cigna Healthcare member data, not an Evernorth incident.
Do I need to sign up to get money?
No. If a settlement covering Cigna members is approved, a court-appointed administrator will send notice and post the claim process. Nothing needs to be filed now, and there is nothing official to file.
What happened with the free credit monitoring?
The original Conduent letters offered two years of monitoring with an enrollment deadline of March 31, 2026. Letters mailed later carry their own enrollment date, so check yours.
What is worth doing right now?
Freeze your credit at all three bureaus. Read your Cigna explanation-of-benefits statements for care you never received. Keep your notice letter and any receipts for costs caused by the breach.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Conduent Data Breach Settlement
The vendor breach behind the Cigna letters, 62.2 million people
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Data Breach Settlement Calculator
Estimate what breach settlements typically pay per person
Settlement Payout Calculator
How class action funds are divided among claimants