FOLLOW US

A data breach is bad enough on its own — but sometimes the cover-up, or at least the delay, becomes the bigger story. That's the backdrop for a sweeping legal resolution now taking shape, as Conduent Business Services LLC has reached a deal to settle claims in a proposed class action alleging it failed to safeguard the sensitive personal and health information of more than 44 million people. The Conduent Data Breach claims settlement closes out a case that had been building steam since a breach first surfaced in early 2025.

The Filing That Confirmed the Deal

Conduent disclosed the agreement in principle to investors through a Securities and Exchange Commission filing, submitted via Form 8-K on Thursday. On the same day, interim co-lead counsel for the plaintiffs notified the court of the proposed settlement, which resolves claims against every defendant named in the case. Notably, neither filing revealed the actual dollar terms of the deal — those details remain behind closed doors for now.

How the Settlement Came Together

According to the plaintiffs, the breakthrough came last month after a full day of intensive negotiations, mediated by retired U.S. Magistrate Judge Diane M. Welsh. Conduent, for its part, maintained in its own filing that it denies the underlying allegations entirely, insisting it believes it has strong defenses against the claims — a settlement reached, in other words, without an admission of fault.

A Breach That Went Undetected for Months

The origins of this case trace back to a troubling stretch between October 2024 and January 2025, when Conduent — a Florham Park, New Jersey-based digital business services provider — allowed unauthorized access to its IT network for nearly three months, according to the amended consolidated complaint filed in June. Even more alarming, the breach itself wasn't publicly disclosed until Oct. 24, 2025 — a gap of many months between detection and disclosure.

A Cascade of Lawsuits

That October 2025 disclosure triggered an immediate wave of legal action, with several plaintiffs filing proposed class actions that same month. The court consolidated those cases into a single proceeding in November 2025.

The Scale of the Exposure

The numbers at the center of this case are staggering. Plaintiffs alleged the breach exposed names, Social Security numbers, dates of birth, and medical and health insurance information belonging to 44.4 million people — a figure the amended consolidated complaint described as marking the third-largest healthcare-related data breach in U.S. history.

The Legal Theories Behind the Claims

The complaint accused Conduent, along with co-defendants Health Care Service Corp. and The Cigna Group, of violating statutory, regulatory and contractual obligations under HIPAA, the Federal Trade Commission Act and common law — specifically by failing to implement reasonable cybersecurity safeguards and by delaying notification to those affected. According to the complaint, the insurers named in the suit had contracted with Conduent for administrative and data processing services, tying the companies together in a shared web of responsibility.

The Ten-Month Gap That Fueled the Outrage

Perhaps the most damning allegation centered on timing. Plaintiffs claimed that although Conduent detected the breach in January 2025 and informed the insurers within days, it then waited more than 10 months before alerting the actual victims and regulators — a delay plaintiffs characterized as inexcusable.

"Defendants' abject failure to timely notify victims left millions of Americans exposed, uninformed, and completely unprotected from identity theft, fraud, and other foreseeable harms that timely disclosure would have helped prevent," the amended consolidated complaint stated.

A Ransomware Gang's Public Boast

Adding a darker twist to the story, plaintiffs alleged that the "notorious" SafePay ransomware gang publicly bragged in February 2025 on its dark-web site about stealing the data, reportedly demanding an undisclosed ransom from Conduent under threat of leaking the stolen information. Conduent has not publicly acknowledged any such ransom demand, according to the complaint.

What the Lawsuit Sought

The suit pursued damages under theories of negligence, negligence per se, unjust enrichment and breach of third-party beneficiary contract, aiming to represent a nationwide class of everyone whose data had been compromised in the breach.

Representatives for the parties did not respond to requests for comment Friday.

The Legal Teams Involved

Plaintiffs were represented by a sprawling coalition of firms: Carella Byrne Cecchi Brody & Agnello PC, Kopelowitz Ostrow PA, Stueve Siegel Hanson LLP, Milberg PLLC, Seeger Weiss LLP, Hausfeld LLP, Dicello Levitt LLP, Lynch Carpenter LLP, Graybill Law Firm PC, Cotchett Pitre & McCarthy LLP, Nussbaum Law Group, Zimmerman Reed LLP and Lite DePalma Greenberg & Afanador LLC.

Conduent's defense came from Caitlin F. Saladrigas, John C. Nix, Mark S. Melodia, Shardul Desai and Stosh M. Silivos of Holland & Knight LLP.

Health Care Service Corp. was represented by Thomas P. Scrivo, Young Yu and Michael A. Botti of O'Toole Scrivo LLC, along with Brian Kavanaugh, Daniel Cochran Craig, Eamon Paul Joyce, Garrett Lance, Geeta Malhotra, Jessica Kowalski and Morgan Branch of Sidley Austin LLP.

The Cigna Group was represented by Adam Joseph Petitt and Stephanie J. Oppenheim of Robinson & Cole LLP.

For the 44 million people whose most personal details were caught in the crossfire, the settlement marks a legal ending — but the ten-month silence that preceded it remains a cautionary tale about just how long a breach can fester in the dark before the truth surfaces.