Change Healthcare Ransomware Breach Grew to 190 Million Victims

UnitedHealth Group said the ransomware attack on Change Healthcare affected about 190 million people, making it the largest known breach of U.S. health and medical data. The February 2024 intrusion, attributed to the Russian-speaking ALPHV/BlackCat operation, triggered nationwide outages that disrupted pharmacy services, insurance claims, prior authorizations, billing, and prescription access, including impacts on military pharmacies. Exposed data reportedly included medical records, diagnoses, medications, test results, treatment plans, insurance details, and financial information.

Reporting and subsequent testimony tied the breach to basic security failures, including use of a stolen credential on an account without multi-factor authentication and weak network segmentation. The fallout widened when RansomHub claimed it had obtained the same stolen dataset—about 4TB of data—after ALPHV allegedly kept a $22 million ransom payment in an apparent exit scam. Hospitals and providers said the prolonged outage strained cash flow and patient care, while UnitedHealth faced HIPAA notifications, lawsuits, congressional scrutiny, and criticism from the American Hospital Association over what it called an inadequate response and funding program.