Conduent proposes $80 million settlement over October 2024 ransomware breach

What happened

• Conduent Business Services faced a class‑action lawsuit after a ransomware breach that began on 21 October 2024 and lasted until 13 January 2025, exfiltrating 8.5 TB of data.
• The breach compromised protected health information of about 62.2 million individuals, making it the largest healthcare breach of 2025.
• A proposed $80 million settlement would provide credit‑monitoring, reimbursement up to $3,500 per person, and additional payments for California residents, pending court approval.

Why it matters

Healthcare organisations that store protected health information must verify that their security controls meet reasonable safeguard standards to avoid similar liability and potential settlement costs.

Business impact

The settlement underscores the financial risk of inadequate cybersecurity and may drive increased investment in breach detection and response capabilities.

What to check

1. 1

   Conduct a comprehensive risk assessmentHigh priority

   Identify gaps in technical and administrative safeguards protecting PHI and personal data.

2. 2

   Update incident‑response planHigh priority

   Include clear timelines for breach detection, containment, and notification to regulators and affected individuals.

3. 3

   Review CCPA complianceMedium priority

   Ensure mechanisms for consumer rights requests, data minimisation, and proper documentation of data inventories.

4. 4

   Enhance encryption and access controlsMedium priority

   Protect backup files and data at rest to prevent easy extraction by unauthorized parties.