UnitedHealth Group has updated the number of individuals impacted by the 2024 Change Healthcare ransomware attack to approximately 190 million, nearly doubling its prior estimate of 100 million.
The revised figure means the Change Healthcare breach is now the largest healthcare data breach in US history by a wide margin. UnitedHealth told Recorded Future News that the final count will be confirmed and sent to the Department of Health and Human Services Office for Civil Rights at a later date.
The company has completed more than 90% of its data review and found no evidence that full medical records or doctors’ charts were exfiltrated. However, the attackers likely accessed health insurance information, medical record numbers, test results, billing data, and personal identifiers including Social Security numbers.
UnitedHealth paid a $22 million ransom to the ALPHV/BlackCat ransomware group, but a dispute among the attackers led to the data being posted on another group’s leak site. The company has spent months reviewing stolen documents to determine notification requirements.
HHS ordered Change Healthcare to file breach notifications on behalf of thousands of affected hospitals, pharmacies, and doctor’s offices. The breach has also triggered multiple class action lawsuits and federal investigations.
