Outsourcing giant Conduent has agreed to put $80m into a fund to settle US litigation over a breach affecting around 62 million people. The company says its cyber insurance means no material financial hit, but the deal still shows UK boards what a supplier compromise actually costs and who ends up paying.
What happened
On 16 October 2026 Conduent told the US Securities and Exchange Commission it had signed a class action settlement agreement. The case is the consolidated lawsuit known as In re: Conduent Business Services Data Breach Litigation before the US District Court for the District of New Jersey. In its Form 8-K filing, the company says it will pay $80m into a non-reversionary fund. That money must cover payments to class members, credit and medical data monitoring, the plaintiffs’ legal fees and the cost of running the scheme. Conduent says the $80m is the whole of its monetary obligation under the agreement.
The case relates to an intrusion that, according to the settlement papers, began around 21 October 2024. Conduent did not find it until about 13 January 2025. The plaintiffs claim the SafePay ransomware group took roughly 8.5TB of data, covering identity details such as Social Security numbers and birth dates alongside medical and health insurance records. According to Infosecurity Magazine, the HIPAA Journal now ranks it as the third largest healthcare data breach on record, behind Change Healthcare and Anthem.
Conduent denies any wrongdoing, and the court still has to approve the settlement. The company says it holds cyber insurance and does not expect the deal to have a material effect on its finances.
The detail
The agreement divides the class in two, based on how easily outsiders could have read the stolen data. According to IBTimes UK, Subclass A covers around 40 million people whose records sat in complex backup formats that were hard for third parties to use. These people get credit monitoring. Subclass B covers about 22 million people whose data was in readily accessible files. They get medical data monitoring instead. If the deal is approved, everyone in the class would receive one year of monitoring automatically. Cash payments are capped at $3,500 and only cover documented losses from fraud or identity theft. People who lived in California on the day the intrusion began get a 20% uplift on their pro rata share.
Spread over 62 million people, $80m works out at about $1.29 each, before anything else is deducted. Class counsel plans to ask for fees of up to 34% of the fund, which is $27.2m, plus costs. Monitoring and administration come out of the same pot. Measured against Conduent’s reported 2025 revenue of $3.04bn, the headline figure is about 2.6% of a single year’s turnover, and Conduent points to its cyber insurance.
Two other terms matter to businesses. Conduent has agreed to strengthen its data security practices. The 8-K also says final approval would release the company, its affected clients and those clients’ affected customers from claims arising from the incident. The clients who handed Conduent their data would be covered by the same release.
Why it matters for UK organisations
This is a US case, but the economics will look familiar to any UK firm that outsources back-office processing, mailroom work, payments or claims handling. Conduent is a data processor: other organisations’ records were stolen from its network. Under UK GDPR the controller remains accountable, and the processor’s contract decides who pays.
The legal routes are different. Opt-out representative claims for data protection damages have been much harder to bring in England and Wales since the Supreme Court’s 2021 ruling in Lloyd v Google, which held that claimants generally have to prove individual loss or distress. That has pushed claimant firms towards opt-in group litigation instead. As a result, a UK breach is more likely to run as a long series of regulatory, contractual and group claims than to end in one tidy settlement. That makes the cost harder to predict, not lower.
UK firms using US-headquartered processors, or holding data on US residents, should assume American class action exposure can reach them through contracts and indemnities.
Expert view
I see three lessons for boards.
First, dwell time drives the bill. On the settlement papers’ account, the attackers were inside for close to three months before anyone noticed. In my experience, long undetected access usually comes from logging nobody reviews and backup stores nobody monitors, not from one missing product. The longer an intruder stays, the more data they can take, and the larger the class that drives a settlement’s cost.
Second, the way data is stored affected the outcome. The split between hard-to-use backup files and readily accessible files fed straight into the remedies offered. Encryption, tokenisation and minimisation do not stop a breach. They do change what the stolen data is worth to criminals and to claimant lawyers. When we test outsourced environments, sensitive data is often sitting in flat exports and shared folders long after the job that needed it has finished.
Third, Conduent’s insurance cover is reassuring for Conduent, but it is not a model to copy without checking. Cyber cover held by a processor protects the processor. Clients should ask whether their supplier’s policy limits match the size of the data set. They should also check whether their own policy responds when the breach happens at a third party. And the release Conduent negotiated for its clients came from US litigation. UK controllers should not assume a supplier will arrange the same protection for them.
What to do now
- Map your processors. List every supplier that holds personal or health data for you, the record volumes involved and the format they hold it in.
- Read the indemnity and liability caps. Check that breach liability, notification costs and third-party claims are covered, and that caps reflect realistic class sizes rather than contract value.
- Ask for evidence of insurance. Request the processor’s cyber policy limits and confirm whether your own policy covers breaches at a supplier.
- Cut detection time. Require suppliers to centralise logs, alert on bulk exfiltration and monitor backup systems. This supports the Cyber Essentials malware protection and secure configuration controls, but goes beyond them.
- Minimise and protect data at rest. Delete stale exports, encrypt backups and restrict access to bulk data stores using the Cyber Essentials user access control principles.
- Keep patching and firewall basics tight across the supply chain. Make Cyber Essentials Plus, or an equivalent tested standard, a minimum requirement for processors handling high-risk data.
- Rehearse a supplier-originated breach. Run a tabletop exercise where a processor tells you three months late that data has been taken, and test your notification, legal and customer communications.
Bottom line
Conduent’s $80m settlement looks manageable because the company expects its insurance to soften the blow and the cost per person is small. The deal still shows how a supplier breach costs money: undetected access, data stored in usable formats, very large class sizes and legal fees that could take a third of the fund. UK organisations that outsource data handling should check their contracts, insurance and supplier monitoring now, before they are the ones explaining a three-month gap to regulators and customers.
Sources
- US SEC: Conduent Incorporated Form 8-K, 16 October 2026
- Infosecurity Magazine: Conduent Agrees to Pay $80m to Settle Data Breach Class Action
- IBTimes UK: Conduent Data Breach Settlement: What 62M People Need to Know About the Proposed $80M Deal
- Reuters via The Daily Guardian: BRIEF-Conduent Reaches Class Action Settlement Agreement
