Conduent Has Agreed to Settle the 62-Million-Person Breach Case — the SEC Filing Says So, but It Names No Dollar Amount, Nothing Is Signed or Approved, and There Is Still Nothing to File.

The disclosure is a single paragraph under Item 8.01, “Other Events,” of a Form 8-K filed September 10, 2026. It describes the litigation — “several lawsuits asserted by or on behalf of individuals who allegedly received a notification letter that their personal information may have been affected by a cybersecurity incident that took place in January 2025,” substantially all consolidated in New Jersey federal court — and then states the news: “in August 2026, the Company reached an agreement in principle to settle the consolidated case,” which “the parties disclosed in a joint status report filed with the Court on September 10, 2026.”

Three things are missing, and each one matters more than the announcement. First, there is no amount — not a fund, not a range, not a per-person figure. The only financial sentence is that Conduent “maintains cyber insurance and does not expect the settlement to have a material impact on its financial position, results of operations or cash flows.” “Not material” describes the effect on Conduent, not the size of the payment; it tells you the deal is not company-threatening, not what it pays. Second, nothing is signed: “the settlement paperwork is not yet finalized.” An agreement in principle is a term sheet, and term sheets have fallen apart before at the drafting stage. Third, nothing is approved: “the settlement agreement has not yet been approved by the court.” A class settlement binds no one until a judge grants preliminary approval, notice goes out, and a final approval order is entered — and Conduent's filing is explicit that even the first of those steps has not happened.

One more gap: the 8-K speaks for Conduent. The consolidated complaint also names Health Care Service Corporation, AIG, The Cigna Group, Elevance Health, Humana and Blue Shield of California. Whether the insurer co-defendants are inside the agreement in principle is not stated. We do not know, and we are not going to assume.

The public docket for No. 2:25-cv-16953 (D.N.J., filed October 27, 2025) lines up with the 8-K. On September 10, 2026 two letters were filed — docket entries 163 and 164 — alongside a “Case Assigned/Reassigned” notation; the docket header as of September 11 still lists Judge Michael E. Farbiarz as the assigned judge and Magistrate Judge Michael A. Hammer as referred. On September 11 a text order was entered and the case flagged “Case Stayed.” That is the ordinary shape of a settlement in the making: the parties tell the court they have a deal, the court freezes the litigation calendar so nobody spends money on motions that a settlement would moot, and the clock starts on drafting.

The letters themselves are not in the free public archive, so we cannot quote the joint status report — we can only say it exists, when it was filed, and what Conduent says it contains. Earlier entries fill in the road here: the court appointed an eight-member Plaintiffs' Steering Committee on December 22, 2025; a consolidated class action complaint uniting 35 suits was filed March 18, 2026 (entry 136) and served on the insurer defendants in April; a May 1 letter order gave the defendants until July 4 to answer or move to dismiss; an amended complaint followed on June 12 (entry 157); a letter and an order on August 18, and a text order on September 4, precede the settlement filings. Our earlier tracker copy said the case was “before Judge Michael A. Hammer” — Hammer is the magistrate judge handling pretrial matters; the presiding district judge is Farbiarz. We have corrected that.

Law360's September 11 report describes the settlement as resolving claims over a breach that “affected 44 million individuals.” Conduent's own regulatory tally, filed with the HHS Office for Civil Rights on June 4, 2026, is 62,224,658 — the third-largest healthcare data breach ever recorded in the United States, behind only the 2024 Change Healthcare attack and the 2015 Anthem breach. Before that, the count had been roughly 10.5 million (October 2025) and 25 million (February 2026); Texas filings alone report about 15.5 million residents.

The two figures are not necessarily in conflict. Regulator counts and the class size a settlement actually covers often differ — a regulator counts everyone notified, a settlement class is whatever the agreement defines. But no public document we have seen reconciles 44 million with 62 million, and the joint status report that might is not available to us. So we report both with their sources and leave the arithmetic where it belongs: undone. What we can say is that any per-person estimate you see for this deal is being computed from a numerator that has not been disclosed and a denominator that has not been agreed.

“Agreement in principle” is the earliest public stage a class settlement has. The sequence from here, in the order it always runs: the parties finalize and sign a settlement agreement; plaintiffs file it with a motion for preliminary approval; the judge rules on that motion; a court-appointed administrator builds an official website and mails or emails notices with a claims deadline, an opt-out deadline and an objection deadline; the claims window runs, typically a few months; a final approval hearing is held; and payments go out only after final approval and after any appeals are resolved. In the healthcare breach settlements we track, the distance from “agreement” to “first check” has run from several months to more than a year. None of those steps has been taken. There is no administrator, no website, no form.

That is why the scam warning on our tracker did not come down — it was rewritten. A settlement being reached does not create a claim form; only a court-approved settlement with an appointed administrator does. Any page, advertisement or social post offering a “Conduent settlement claim” today is selling something that does not exist, and a site that quotes your real Social Security number or insurance ID is not proving it is legitimate — the thieves have those too.

What is still worth doing now costs nothing: keep the notification letter Conduent mailed you, because it is the document that shows you are in the class; place credit freezes at Equifax, Experian and TransUnion, the strongest protection when a Social Security number is exposed; and watch health-insurance Explanation of Benefits statements for services you never received. The free two-year credit-monitoring offer in the original letters carried a March 31, 2026 enrollment deadline; if your letter arrived later, the deadline printed in it governs. If the deal follows the pattern of comparable healthcare mega-breaches, expect reimbursement of documented losses plus a small pro-rata cash payment that shrinks as the class grows — and this class is 62 million people. That is a pattern from other cases, not a term of this one. We will update the tracker when the agreement is filed and again when a claims process opens; the docket is where the next step will appear first.