Cybersecurity: Infosys’ US unit to pay $18mn fine

BENGALURU: Infosys McCamish Systems (IMS), a subsidiary of Infosys BPM, has agreed to put $17.5 million into a fund to settle pending class-action lawsuits and resolve allegations following a cybersecurity incident in 2023. Infosys said that it reached an agreement with the plaintiffs of these lawsuits pending against IMS and a few of its customers.
“On March 13, 2025, McCamish and the plaintiffs engaged in mediation, resulting in an agreement in principle, which sets forth the terms of a proposed settlement of class-action lawsuits against McCamish, as well as class-action lawsuits filed against McCamish’s customers. Under the proposed settlement terms, McCamish agreed to pay $17.5 million into a fund to settle this matter,” the company said in a stock exchange filing.
McCamish Systems was impacted by a cybersecurity incident in 2023 that resulted in the non-availability of certain applications and systems in McCamish. Infosys McCamish is a platform-based BPO firm that provides services to the financial services sector, supporting life insurance and annuity products and retirement plans. It is also a software reseller for industry-specific clients. McCamish was acquired by Infosys BPM (formerly Infosys BPO) in 2009.
Last year, many security chroniclers reported that the LockBit ransomware gang took responsibility for the attack. Last year, one of Infosys’s key customers, Bank of America (BofA), named IMS as the source of a data breach that affected 57,028 customers.
McCamish said that its in-depth cyber forensic investigation determined that unauthorised activity occurred between October 29, 2023, and November 2, 2023. Infosys said the loss incurred with respect to remediations, restoration, and communication efforts was around Rs 250 crore ($30 million).
Infosys said that the proposed terms are subject to confirmation and due diligence by the plaintiffs, finalisation of the terms of the settlement agreement, as well as preliminary and final court approval. “Once approved, the settlement will resolve all allegations made in the class-action lawsuits without admission of any liability,” the filing said.