UnitedHealthcare Nearly Doubles Estimate of Feb. 2024 Data Breach Victims

Most of those affected “have already been provided individual or substitute notice," UnitedHealthcare said in an emailed statement. "The final number will be confirmed and filed with the [U.S. Department of Health and Human Services] Office for Civil Rights at a later date. Change Healthcare is not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis.”

Nebraska Attorney General Mike Hilgers filed a lawsuit against the company last month, alleging that UnitedHealthcare violated the state’s Consumer Protection and Data Security Laws.

In February 2024, Change Healthcare suffered a significant data breach after a low-level customer service representative’s account was hacked, exposing social security numbers, bank accounts and medical information about individuals, Hilgers said. For nine days, the hackers had unfettered access to Change Healthcare’s system and consumer data, Hilgers said. While the company was required to give reasonable notice to affected customers -- somewhere between 30 and 120 days -- Change Healthcare didn't issue notices until the summer, which was after the AG office got involved in March and issued a public notice in May, he said.

“We continue to notify potentially impacted individuals as quickly as possible, on a rolling basis, given the volume and complexity of the data involved, and the investigation is still in its final stages,” Change Healthcare said in December, after Hilgers announced the lawsuit.