Judge Asks for More Information Before Approving Conduent’s $80 Million Data Breach Settlement Covering About 62 Million People

Most of the roughly 62 million people caught up in the Conduent data breach never did business with Conduent directly. The company works behind the scenes for health insurers, employers and government benefit programs, and that is how their names, Social Security numbers and medical details ended up in its systems. Conduent has agreed to an $80 million settlement, but on Oct. 22 the federal judge overseeing the case declined to sign off yet and asked for more information.

Why the judge held off

Judge Michael E. Farbiarz of the U.S. District Court for the District of New Jersey did not grant preliminary approval in his Oct. 22 opinion and order. According to an Open Class Actions review of the ruling, the court said it could not evaluate the $80 million figure without “the larger baseline of total possible damages” and an explanation of how that baseline was calculated.

The judge raised several other questions, according to the same review. The filings lacked underlying information on liability risk, such as documents and witnesses. The court asked what cash relief class members gave up in exchange for monitoring services and what that monitoring generally costs. It also noted that the proposed notices were filed only in English, and suggested deciding later how any leftover money would be handled.

The order does not reject the deal. The plaintiffs have until Nov. 5, 2026, to file supplemental materials, and the judge could approve the settlement after reviewing them. The case is In re: Conduent Business Services Data Breach Litigation, No. 2:25-cv-16953, and filings are posted on the court docket.

Who is covered and what the deal would pay

Conduent disclosed the agreement in an Oct. 16 Form 8-K filed with the Securities and Exchange Commission, saying it “will fund $80 million into a non-reversionary settlement fund” covering class recovery, credit and medical data monitoring, attorneys’ fees and administration. The company said it maintains cyber insurance and does not expect the settlement to have a material financial impact, and that the agreement “is not an admission of fault or liability, which the Company denies.”

The settlement agreement defines the class as “all individuals residing in the United States who are on the Class List” and were notified that their information may have been affected. It splits them into two groups:

• Subclass A, about 40 million people whose information was taken, would receive one year of automatic credit monitoring with one credit bureau.
• Subclass B, about 22 million people whose files were “readily accessible,” would receive one year of medical data monitoring plus a pro rata cash payment that requires no documentation.

Subclass B members who lived in California on Oct. 21, 2024, would get “a 20% upward adjustment” to their cash payment under the agreement. Members of either group could also claim up to $3,500 for documented losses from fraud or identity theft, with supporting records required; Open Class Actions notes that a personal statement alone would not be enough.

The deal also includes service awards of up to $1,500 per class representative and a commitment from Conduent to add security measures. Its release would cover Conduent, the clients whose data was affected and those clients’ customers, which means class members who stay in would give up claims against their insurer or benefit program over this breach as well.

Class counsel would request up to 34% of the fund in attorneys’ fees, the agreement says, which on $80 million would come to as much as $27.2 million. Epiq Class Action & Claims Solutions is the proposed administrator. The size of each Subclass B cash payment has not been estimated, since it depends on fees, monitoring and administration costs, documented-loss payments and the number of valid claims.

From a 2024 intrusion to a 2026 deal

The timeline stretches back two years. Open Class Actions reports that unauthorized access to Conduent’s systems began around Oct. 21, 2024, and was discovered on or about Jan. 13, 2025. Notification letters began going out in October 2025, and more than 30 proposed class actions followed, which were consolidated in New Jersey.

Depending on the person, the exposed files included names, Social Security numbers, addresses, dates of birth, medical information, health insurance information and financial account information. The number of people affected, about 62 million under the settlement agreement, is far larger than the roughly 10.5 million first reported for health insurance customers.

Conduent offered its own credit monitoring after the breach, but that enrollment closed March 31, 2026, according to the review. The settlement’s monitoring would be separate and could be activated only after final approval.

No claim form exists yet

Nothing can be filed today. No settlement administrator has been appointed, no notices have gone out and no claim deadline exists, Open Class Actions reports. Under the proposed schedule, notice would start 40 days after preliminary approval, claims would be due 75 days after notice begins, and a final approval hearing would be set for 2027.

That gap is when scammers move in. Any call, text or email offering a Conduent settlement payment in exchange for a fee or bank information is not connected to the case, since legitimate settlements do not charge people to receive money.

People who received a Conduent breach letter can keep it, along with any records of fraud or identity theft costs, which would matter for the $3,500 documented-loss tier. Other large data breach cases have taken months to move from approval to payment, as with AT&T’s $177 million settlement and 23andMe’s $46.75 million settlement.

Get stories like this by email. Sign up for The Parent Diaries Letter.

This article was produced with AI assistance and edited for accuracy against the sources linked above.

Image: Carl Lender from Sunrise, USA – CC BY 2.0/Wikimedia Commons