Infosys Limited—Infosys agreed to pay $17.5M to settle US lawsuits over 2023 McCamish Systems ransomware breach exposing millions of insurance customers' data
Infosys agreed to pay $17.5 million to settle US class-action lawsuits over a November 2023 ransomware attack on McCamish Systems, its US life-insurance BPO subsidiary, that exposed highly sensitive personal, financial, and medical data belonging to an estimated 3.7-6.5 million individuals across multiple insurer clients. The settlement, filed in March 2025, offers reimbursement up to $6,000 per class member plus two years of credit monitoring; Infosys denied liability as part of the settlement.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | primary | -1.00 |
| User Privacy | -against | secondary | -0.50 |
| Overall incident score = | -0.332 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.59)× agency (negligent ×0.5)
Evidence (1 signal)
Reuters: Infosys settles US lawsuits over McCamish Systems cyber incident for $17.5 million
Reuters reported Infosys agreed to a $17.5 million settlement of US class-action lawsuits over the 2023 ransomware breach at its McCamish Systems life-insurance BPO unit; Infosys's own exchange filing detailed the proposed settlement terms, including per-member reimbursement caps and credit-monitoring services.