Conduent Incorporated and Conduent Business Services, LLC (collectively, the "Company") are parties to several lawsuits in the U.S. asserted by or on behalf of individuals who allegedly received a notification letter that their personal information may have been affected by our previously disclosed cybersecurity incident that took place in January 2025. Substantially all of these lawsuits have been consolidated into one single action in the U.S. District Court, District of New Jersey (In re: Conduent Business Services Data Breach Litigation). The Company denies plaintiffs' allegations and believes that it has strong defenses to plaintiffs' claims. Nevertheless, to avoid the costs and burdens of litigation, in August 2026, the Company reached an agreement in principle to settle the consolidated case, which the parties disclosed in a joint status report filed with the Court on September 10, 2026. The settlement paperwork is not yet finalized, and the settlement agreement has not yet been approved by the court. The timing of the final court approval of the settlement agreement cannot be predicted with certainty as it will depend on a number of factors outside of the Company's control. The Company maintains cyber insurance and does not expect the settlement to have a material impact on its financial position, results of operations or cash flows.