Infosys to settle data breach case in BPM unit by paying $17.5 million

As of March 31, 2024, Infosys reported $38 million in costs from the breach, covering revenue losses, system restoration, legal fees, and investigative efforts, all stemming from a security vulnerability in the Infosys McCamish platform

Infosys has reached an agreement to pay $17.5 million to settle a class-action lawsuit stemming from a major McCamish data breach that occurred in late 2023. The breach, which impacted the company’s BPM unit, Infosys McCamish, compromised sensitive customer information and disrupted operations at the division.

McCamish, a platform-based business process outsourcing (BPO) provider specializing in life insurance and retirement services, was acquired by Infosys BPM in 2009. The breach affected the data of approximately 57,000 Bank of America (BofA) customers, one of Infosys’s largest clients. Exposed information included names, addresses, Social Security numbers, and details related to BofA’s deferred compensation plan.

In a statement released on March 14, Infosys clarified that the settlement is still pending finalization, pending due diligence, and approval by the court. Once completed, the settlement will resolve all claims made in the Infosys lawsuit without an admission of liability.

Infosys commits to enhanced cybersecurity

The financial impact of the breach has been significant for the company. As of March 31, 2024, Infosys reported $38 million in costs related to the breach, including revenue losses, system restoration, legal expenses, and efforts for communication and investigation. The breach was linked to a security vulnerability within the Infosys McCamish platform, which led to the exposure of personal information.

As part of its response to the breach, Infosys has committed to improving its cybersecurity infrastructure to prevent similar incidents in the future. The company has emphasized its dedication to resolving the situation and restoring the confidence of its clients, particularly those whose data was compromised in the Infosys security breach. The settlement also highlights the increasing legal and financial risks companies face in handling sensitive customer information.