$80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation

What happened

Conduent Business Services faced a class‑action lawsuit after a ransomware breach that began on 21 October 2024 and lasted until 13 January 2025, exfiltrating 8.5 TB of data. The breach compromised protected health information of about 62.2 million individuals, making it the largest healthcare breach of 2025. A proposed $80 million settlement would provide credit‑monitoring, reimbursement up to $3,500 per person, and additional payments for California residents, pending court approval.

Why it matters

Healthcare organisations that store protected health information must verify that their security controls meet reasonable safeguard standards to avoid similar liability and potential settlement costs.

Business impact

The settlement underscores the financial risk of inadequate cybersecurity and may drive increased investment in breach detection and response capabilities.

Checklist

• Conduct a comprehensive risk assessmentHigh priority

  Identify gaps in technical and administrative safeguards protecting PHI and personal data.

• Update incident‑response planHigh priority

  Include clear timelines for breach detection, containment, and notification to regulators and affected individuals.

• Review CCPA complianceMedium priority

  Ensure mechanisms for consumer rights requests, data minimisation, and proper documentation of data inventories.

• Enhance encryption and access controlsMedium priority

  Protect backup files and data at rest to prevent easy extraction by unauthorized parties.

Who reported it

Discussion