Loading story…
A federal judge in Minnesota approved a strict protocol governing how data stolen in Change Healthcare’s 2024 cyberattack may be accessed, handled, and protected during ongoing litigation. Magistrate Judge Dulce J. Foster signed the order on August 7 after the parties agreed to the terms, and the rules now apply to the consolidated lawsuit involving UnitedHealth Group, Change Healthcare, Optum, and United HealthCare Services.
The court order focuses on safeguarding stolen patient personal and health information used in the case rather than disclosing new technical details about the breach itself. Plaintiffs’ counsel retained a cybersecurity expert who told the court the proposed safeguards were sufficient, and the order establishes tighter controls over breached data as the litigation over the attack proceeds.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
On August 7, Magistrate Judge Dulce J. Foster approved a strict protocol governing access to and handling of data stolen in the 2024 Change Healthcare cyberattack during ongoing litigation. The order applies to the consolidated lawsuit against UnitedHealth Group and affiliated companies including Change Healthcare, Optum, and United HealthCare Services.
On June 7, 2024, the Judicial Panel on Multidistrict Litigation consolidated an initial 49 lawsuits over the Change Healthcare cyberattack, including consumer and healthcare provider complaints. The litigation was centralized in the U.S. District Court for the District of Minnesota as In Re: Change Healthcare, Inc. Customer Data Security Breach Litigation.
In 2024, Change Healthcare suffered a cyberattack that led to the theft of patient personal and health information. The incident later became the subject of consolidated litigation against UnitedHealth Group and affiliated companies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iowa Attorney General Brenna Bird sued Change Healthcare, UnitedHealth Group, and Optum over the 2024 ransomware attack on Change Healthcare, alleging the companies misrepresented their cybersecurity practices, understated the breach’s severity in a February 2024 SEC filing, and operated insecure legacy systems without adequate segmentation or redundancy. The complaint says the attack exposed the electronic protected health information of **192.7 million Americans**, including **2.2 million Iowans**, making it the largest healthcare data breach in U.S. history, and seeks civil penalties, disgorgement, damages, and injunctive relief. The incident is also being cited across the healthcare sector as a defining example of **systemic third-party risk**, after outages disrupted billing, pharmacy, clinical, imaging, and laboratory operations at thousands of organizations for months. Industry leaders, including Intermountain Health CISO Erik Decker, said the attack showed how vendor concentration can create ecosystem chokepoints, while broader reporting on vendor breaches has reinforced concerns that compromises at major service providers can cascade across healthcare delivery and data security nationwide.
Jun 29, 2026
The US Department of Health and Human Services (**HHS**) is increasing scrutiny of **third-party service provider** cybersecurity in the healthcare sector following the 2024 **Change Healthcare** cyberattack, which HHS officials describe as having threatened the “liquidity” of the broader healthcare system. HHS’s Charlee Hess (Administration for Strategy Preparedness and Response) said the incident exposed previously underappreciated systemic risk from external vendors that can have outsized sector-wide impact, and noted HHS is working through a methodology—alongside industry—to identify where those critical third-party dependencies and risk concentrations exist. Reporting reiterated that the Change Healthcare intrusion began with attackers exploiting the lack of **multi-factor authentication (MFA)** on a remote access portal and ultimately exposed data affecting roughly **190 million** people. The breach has also driven broader government and industry responses, including proposals for mandatory cybersecurity requirements on hospitals (which healthcare organizations have opposed as burdensome, arguing the Change Healthcare compromise originated with an external vendor) and remediation actions by **UnitedHealth Group** (Change Healthcare’s parent) to “start over” on aspects of its systems and technology environment.
Jun 29, 2026
A ransomware attack on UnitedHealth subsidiary **Change Healthcare** crippled prescription processing, billing, and claims services across the U.S., leaving pharmacies, hospitals, doctors, and therapists unable to process insurance transactions and creating severe cash-flow problems for providers. UnitedHealth disclosed the intrusion after isolating affected systems, and the **ALPHV/BlackCat** gang later claimed responsibility, saying it stole terabytes of data from the company’s environment. The outage highlighted Change Healthcare’s central role in the health sector, where it processes a huge share of medical and pharmacy transactions. UnitedHealth later acknowledged paying a ransom reportedly worth about **$22 million** in bitcoin, but the extortion did not end there: a second group, **RansomHub**, claimed it had obtained the stolen files and began leaking patient data online. Subsequent reporting said the breach likely included highly sensitive personal and health information, potentially affecting U.S. service members and eventually tens of millions of Americans, with later estimates rising to **100 million** and then **193 million** victims. Investigators and executives also said the attackers entered through a **Citrix portal without MFA**, turning the incident into one of the largest and most consequential healthcare data breaches on record.
Jun 29, 2026