Infosys Agrees to Pay $17.5 Million to Settle Lawsuits Over McCamish Cyber Incident

Infosys has agreed to pay $17.5 million to settle six class action lawsuits related to a cyber incident at its subsidiary, Infosys McCamish Systems (IMS). The Bengaluru-based IT major confirmed that the settlement, once approved, would resolve all allegations without admission of liability.

Settlement Details

Infosys announced on March 14 that it had reached an agreement in principle with the plaintiffs involved in six class action lawsuits against IMS and several of its customers. The lawsuits stem from a November 2023 cyber incident that led to the disruption of certain applications and systems.

The company stated that mediation with the plaintiffs took place on March 13, 2025, leading to the proposed settlement agreement. Once finalized, the settlement will bring an end to all pending legal disputes related to the cyber incident.

Background of the Cyber Incident

The lawsuits were triggered by a cyber attack on Infosys McCamish Systems in November 2023, which resulted in system outages and operational disruptions. Following the incident, Infosys worked with a leading cybersecurity provider to resolve the issue and launched an independent investigation to assess the impact on systems and data.

Company’s Response and Future Measures

Infosys reiterated its commitment to data protection and cybersecurity, emphasizing that safeguarding customer information remains a top priority. The company has taken measures to enhance its cybersecurity infrastructure and mitigate future risks.

In a regulatory filing, Infosys stated, "Data protection and cybersecurity are of utmost importance to us. We have engaged leading experts to strengthen our security framework and prevent similar incidents in the future."

Industry Impact and Market Reaction

The cyber attack and resulting legal battle have raised concerns about cybersecurity vulnerabilities within IT services firms. The settlement is expected to provide relief to affected customers while allowing Infosys to focus on strengthening its security measures and restoring confidence among stakeholders.

As businesses increasingly rely on digital infrastructure, the incident underscores the importance of robust cybersecurity practices to prevent financial and reputational damage.