UnitedHealth updates data breach impact to 190 million affected individuals

UnitedHealth confirms 190 million individuals affected by last year’s ransomware attack on Change Healthcare systems.

UnitedHealth reveals last year’s ransomware attack on Change Healthcare affected 190 million people, nearly double the initial estimate.

The updated figure, reported Friday and first disclosed by The Wall Street Journal, highlights the scale of the breach that compromised sensitive healthcare data.

A UnitedHealth spokesperson confirmed that “the vast majority of those impacted have already been notified,” with final numbers expected to be submitted to the Department of Health and Human Services (HHS) at a later date.

The cyberattack exposed sensitive information, including names, addresses, Social Security numbers, health insurance details, and financial data. UnitedHealth also acknowledged that while medical record numbers, diagnoses, test results, and other health information were accessed, it found “no evidence” that full medical histories or electronic medical records were exfiltrated.

UnitedHealth, which processes nearly one-third of all U.S. medical records and claims, previously admitted that hackers accessed extensive personal and financial information. The company paid a $22 million ransom to the attackers, though the data was later leaked due to internal disputes within the hacking group.

Change Healthcare has spent months reviewing stolen data and notifying affected hospitals, pharmacies, and patients. HHS has mandated breach notifications to ensure impacted individuals, including vulnerable populations, are informed.

This breach has raised concerns about the security of healthcare data and underscores the ongoing threat of ransomware attacks on critical industries.