Conduent Incorporated has agreed to fund $80 million to settle the consolidated class action over its January 2025 cybersecurity incident, according to an SEC filing dated October 16, 2026.
In the Form 8-K, Conduent says it entered into a Class Action Settlement Agreement and Release with the plaintiffs in In re: Conduent Business Services Data Breach Litigation, pending in the U.S. District Court for the District of New Jersey. The $80 million non-reversionary fund covers payments to class members, the cost of credit and medical data monitoring, the fees of the plaintiffs’ counsel and the cost of administering the settlement, and Conduent calls it its total monetary obligation under the agreement.
The filing says that on final approval the agreement releases Conduent, its affected clients and those clients’ affected customers from claims arising out of the incident. It states that the agreement is not an admission of fault or liability, which Conduent denies, and that it remains subject to court approval. Conduent also says it maintains cyber insurance and does not expect the settlement to have a material impact on its financial position, results of operations or cash flows.
For risk teams the release language is the part to read twice. The agreement is written to cover the vendor’s clients and their customers, so a company that outsourced a function may find claims against it resolved by a deal it did not negotiate. Contract owners can check what their own vendor agreements say about who pays for notification and monitoring after a provider is breached.
In our reading, a fixed fund that includes legal fees and administration is a data point for third-party risk reviews, next to the earlier BAE Systems incident affecting the federal bankruptcy noticing center and the iRhythm disclosure about third-party hosted apps. Both show one operator’s problem reaching many customers at once.
Source: Conduent Incorporated, Form 8-K dated October 16, 2026
