Infosys reaches $17.5 million settlement over cybersecurity lawsuits

Infosys, a global technology services and consulting company headquartered in Bangalore, India, has agreed to pay $17.5 million to settle six class action lawsuits in the United States following a cybersecurity incident involving its subsidiary, Infosys McCamish Systems (McCamish).

The lawsuits were filed in response to a November 2023 cyber event that disrupted McCamish’s applications and systems, leading to allegations of compromised security and service disruptions.

In a stock exchange filing, Infosys confirmed that it had reached an agreement in principle with the plaintiffs, resolving all pending class action lawsuits related to the incident. The proposed settlement will also address claims against McCamish’s customers who were affected by the breach.

According to Infosys, mediation discussions took place on March 13, 2025, resulting in a preliminary settlement agreement. Under the terms of the agreement, McCamish will contribute $17.5 million to a settlement fund to resolve all claims. However, the settlement remains subject to confirmation, due diligence by the plaintiffs, finalization of terms, and both preliminary and final court approval. Infosys emphasized that the agreement does not constitute an admission of liability.

Following the November 2023 cyber incident, Infosys worked with a cybersecurity products provider and launched an independent investigation to assess the breach’s impact. The company reiterated its commitment to data protection and cybersecurity, stating that safeguarding client and customer information remains a top priority.