Conduent Data Breach: Is There a Settlement? (August 2026 Status)
One of the largest healthcare data breaches in U.S. history: Conduent Business Services — a back-office contractor that processes data for major health insurers and state benefit programs — confirmed in a June 2026 federal filing that 62,224,658 people were affected, up from the 10.5 million first reported. Stolen data includes Social Security numbers and medical information. Here's the honest status: no settlement exists yet — and here's what you should actually do today.
Last reviewed: April 2026
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened — and What the Lawsuits Allege
For nearly three months, from October 21, 2024 to January 13, 2025, intruders had access to the network of Conduent Business Services, a New Jersey-based company that handles mailroom, payment processing, and back-office work for some of the largest U.S. health insurers and for state benefit programs. The SafePay ransomware group claimed responsibility in February 2025 and said it took roughly 8.5 terabytes of data (the attackers' own figure, not independently verified). The consolidated class actions allege negligence, breach of contract, violations of the FTC Act and state consumer-protection laws, failure to comply with HIPAA — and that Conduent took nearly ten months to notify affected people after discovering the breach.
Case Details
More than 35 federal class actions are consolidated as In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, in the U.S. District Court for the District of New Jersey before Judge Michael A. Hammer. The court appointed an eight-member Plaintiffs' Steering Committee on December 22, 2025; a consolidated amended complaint uniting 35 suits followed on March 18, 2026, also naming Health Care Service Corporation (Blue Cross Blue Shield) and AIG Procurement Services. There is NO settlement administrator and NO official claims site for this breach — none exists.
Current Status
Who Is Affected?
Conduent's final regulatory tally, filed with HHS on June 4, 2026, puts the breach at 62,224,658 people — the third-largest healthcare data breach in U.S. history — after earlier counts of roughly 10.5 million (October 2025) and 25 million (February 2026). Conduent processes data for health insurers and state programs; clients confirmed affected include Blue Cross Blue Shield plans operated by Health Care Service Corporation (Texas, Illinois, Montana), Premera Blue Cross, and Humana, plus state agencies such as the Wisconsin Department of Children and Families and Oklahoma Human Services. Texas filings alone report roughly 15.5 million residents affected. If you received a letter from Conduent Business Services about this incident, you are affected.
Is There a Payout?
Timeline
- 1
October 21, 2024 – January 13, 2025 — Network Intrusion
Attackers maintain access to Conduent's systems for nearly three months. Conduent — a business-services contractor spun off from Xerox in 2017 that handles back-office processing for insurers and government benefit programs — detects and stops the intrusion on January 13, 2025.
- 2
January–February 2025 — Disclosure and Ransomware Claim
Conduent discloses an operational disruption in January 2025 and later details the incident in SEC filings. In February 2025 the SafePay ransomware group claims the attack, saying it took roughly 8.5 TB of data — the attackers' own, unverified figure. The group later removes Conduent from its leak site.
- 3
October 24, 2025 — Notification Letters Begin Mailing
Nearly ten months after discovery, letters start going out — some reach consumers as late as January 2026. Initial regulator filings put the count at roughly 10.5 million people. Letters offer two years of free credit monitoring and identity restoration with an enrollment deadline of March 31, 2026.
- 4
November–December 2025 — Lawsuits Consolidate in New Jersey
Class actions stack up in the U.S. District Court for the District of New Jersey and are consolidated as In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953. On December 22, 2025 the court appoints an eight-member Plaintiffs' Steering Committee to coordinate the litigation.
- 5
February–March 2026 — Count Passes 25 Million, States Investigate
State filings push the total past 25 million. The Texas Attorney General opens an investigation, calling it 'likely the largest breach in U.S. history.' On March 18, 2026 a consolidated amended complaint unites 35 suits and also names Health Care Service Corporation (BCBS) and AIG Procurement Services as defendants; motion-to-dismiss briefing follows in spring 2026.
- 6
June 4, 2026 — Final Federal Tally: 62.2 Million
Conduent's updated filing with HHS OCR confirms 62,224,658 affected individuals — the third-largest healthcare data breach ever recorded in the U.S., behind only the 2024 Change Healthcare attack and the 2015 Anthem breach.
- 7
Settlement — Not Yet
When a settlement fund, administrator, and claim form actually exist, this page will be updated with the official links and deadlines. Until then: there is nothing to file.
Scam & Misinformation Warnings
A breach touching 62 million people — Social Security numbers and medical data included — is a magnet for fraud. Watch for these:
Fake 'Conduent settlement claim' sites
No claims portal exists. Any page, ad, or social post offering a Conduent payout form today is a scam or clickbait. When a real settlement comes, the administrator's URL will appear in court filings — and on this page.
Phishing that quotes your real data
The thieves HAVE real Social Security numbers, insurance member IDs, and claims data — a call or email quoting your genuine details is not proof it's legitimate. Conduent's official outreach came by mailed letter with an assistance number printed in it. Never hand personal information to an inbound caller citing this breach.
Fee-charging 'lawsuit sign-up' or 'breach protection' services
Nobody legitimate charges to 'add you' to this class action — if a class is certified, affected people are included automatically. Credit freezes at Equifax, Experian, and TransUnion are free by law; skip any paid 'breach protection' upsell.
Frequently Asked Questions
Is there a Conduent data breach settlement?
No. As of August 14, 2026 there is no settlement, no claims administrator, and no fund. What exists: 35+ class actions consolidated as In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, in New Jersey federal court. Given the scale — 62.2 million people, Social Security numbers plus health data — a settlement is realistic over a 1–3 year litigation path. Bookmark this page; we update it when a claims process exists.
I got a Conduent letter — what should I do right now?
Four things: (1) Keep the letter — it documents that you're in the affected group. (2) The free credit-monitoring enrollment deadline in the original letters was March 31, 2026; if your letter is newer, check the deadline printed in it. (3) Freeze your credit for free at Equifax, Experian, and TransUnion — the strongest protection when your SSN is exposed. (4) Watch bank statements and health-insurance Explanation of Benefits documents for services you never received.
How much money will I get?
Honestly: $0 today — there is no fund. For a realistic reference point if a settlement eventually happens: comparable healthcare mega-breach settlements have paid documented out-of-pocket losses (often capped around $5,000–$10,000) plus small pro-rata cash payments (typically $50–$100). That is speculation until an actual settlement exists.
I've never heard of Conduent — why did they have my data?
Conduent is a business-services contractor (spun off from Xerox in 2017) that handles mailroom, payment processing, and back-office work for health insurers and state benefit programs — it processes data for a large share of Americans who never deal with it directly. Clients confirmed affected in this breach include Blue Cross Blue Shield plans operated by Health Care Service Corporation, Premera Blue Cross, Humana, the Wisconsin Department of Children and Families, and Oklahoma Human Services.
What data was stolen?
Depending on the individual: name, address, date of birth, Social Security number, email, phone, and medical or health-insurance information such as treatment and claims data. Not every element applies to every person — your notification letter states what was involved for you.
Do I need to sign up for the lawsuit?
No. If a class is certified or a settlement is reached, everyone who fits the class definition is included automatically — you'd only act later to file a claim or opt out. Be wary of sites urging you to 'register for the Conduent lawsuit' today; at this stage nobody can add you to anything.
When will there be a settlement?
Data-breach class actions of this size typically take 1–3 years from consolidation (late 2025) to a settlement — if they settle at all. The milestones to watch: the motion-to-dismiss ruling, discovery, mediation, then preliminary approval. We update this page at each milestone.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
DentaQuest Breach (23M+ affected)
Healthcare breach — same no-settlement-yet stage
Medtronic Breach (3.8M affected)
Healthcare breach — same no-settlement-yet stage
HCIactive Breach (3M affected)
Healthcare breach — same no-settlement-yet stage
Data Breach Settlement Calculator
All breach trackers + payout estimator