Infosys to pay $17.5M over McCamish cyber attack
What's the story
Infosys has agreed to settle all allegations stemming from a "cyber incident." The Bengaluru-based IT giant has agreed to pay $17.5 million, settling six class action lawsuits against its subsidiary Infosys McCamish Systems (IMS) and some of its clients. The company said the proposed agreement would settle all pending class action lawsuits (without admitting any liability) once approved.
Mediation outcome
Settlement reached after mediation
The settlement was reached after a mediation session between IMS and the plaintiffs on March 13, 2025. The lawsuits were filed after a November 2023 cyber incident rendered certain applications and systems unavailable at IMS. Addressing the issue, Infosys had said it was working with a leading cybersecurity products provider for a swift resolution and had launched an independent investigation into potential impacts on systems and data.
Incident details
Cyber incident affected millions, led to lawsuits
The cyber incident that led to the lawsuits involved unauthorized access and data exfiltration of up to 6.5 million people's information. This information was flagged by IMS along with its third-party vendor, eDiscovery. The settlement terms are subject to confirmation and due diligence by the plaintiffs, finalization of the terms of the settlement agreement, and preliminary and final court approval.
Strategic partnership
Infosys announces expanded collaboration
In a separate announcement, Infosys also revealed an expansion of its strategic collaboration with Citizens Financial Group. Under this agreement, Citizens will leverage Infosys's financial services expertise and technologies such as AI, cloud, and automation to build cloud-native domain platforms. The partnership will create hyper-personalized AI-powered customer experiences while improving operational resilience and stability.