Infosys McCamish Settles Class Actions Over 2023 Ransomware Attack

A settlement has been reached to resolve multiple class action lawsuits against Infosys McCamish Systems, a US subsidiary of India-based Infosys. Steve Alder, editor of The HIPPA Journal, writes that the $17.5 million settlement of suits, including John McNally, Joyce Newman, et al individually and on behalf of all others similarly situated v. Infosys McCamish Sys., LLC, follows a 2023 ransomware attack.

Infosys McCamish Systems provides life insurance and retirement software and services. In November 2023, it discovered that its systems had been breached between October 29 and November 2.

The ransomware attack resulted in the exfiltration of vast amounts of personal and financial data, including Social Security numbers, bank details, and medical information.

Initially, the company reported 57,000 affected individuals, but by June 2024, that number had been revised to over 6 million. The company restored affected systems by December 31, 2023, and hired third-party investigators to assess the breach’s impact.

Following the breach, multiple class action lawsuits were filed, alleging negligence, delayed breach notifications, and inadequate security measures. Plaintiffs claimed damages such as invasion of privacy, financial losses, and an increased risk of identity theft.

Additional claims included negligence per se, breach of contract, and unjust enrichment. While Infosys McCamish denied liability, a settlement was agreed upon in principle in March 2025, pending court approval.

Lawyers should note that the settlement comes after allegations that Infosys McCamish delayed issuing notifications about the data breach and that when the letters were sent, they lacked sufficient information, diminishing the ability of class members to mitigate the harms it caused. Infosys McCamish Systems denies those claims in the lawsuit and any wrongdoing.