About 190 million Americans may have been affected by a cyberattack targeting UnitedHealth‘s subsidiary, Change Healthcare. The breach, which disrupted the company’s IT systems, resulted in the compromise of sensitive personal and medical information.

“Change Healthcare has determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million,” Tyler Mason, a spokesperson for UnitedHealth Group, told TechCrunch. “The vast majority of those people have already been provided individual or substitute notice. The final number will be confirmed and filed with the Office for Civil Rights at a later date.”

Medical Data and Financial Details Compromised

UnitedHealth disclosed that the breach involved the exposure of names, physical addresses, birth dates, Social Security numbers, driver’s license numbers, passport numbers, and sensitive medical and financial data. At this time, however, it’s not clear whether anyone’s personal information has been misused by hackers, PC Mag reported.

Mason told TechCrunch that he’s “not aware” of “any misuse of individuals’ information.” Additionally, Mason confirmed that “UnitedHealth has not seen electronic medical record databases appear in the data during the analysis.”

AlphV/BlackCat Identified as Hackers

The attack, which officials attributed to the Russian-speaking ransomware group AlphV/BlackCat, may cost UnitedHealth approximately $2 billion. UnitedHealth confirmed that the breach occurred in February 2024, making it the largest medical data breach in U.S. history. The attack caused widespread outages in the healthcare system, lasting for months.

UnitedHealth Paid Ransoms to Protect Stolen Data

Change Healthcare, which processes healthcare claims and manages medical records for millions of patients, confirmed it paid two ransoms to prevent hackers from publishing the stolen records. The payments highlight the critical role Change Healthcare plays as one of the largest health tech companies in the U.S.

Healthcare System Disruptions and Future Implications

The breach exposed vulnerabilities in healthcare IT infrastructure, prompting calls for stronger cybersecurity measures across the industry. While officials continue to analyze the data, the long-term effects of the attack on patients and healthcare providers remain uncertain.

UnitedHealth

Get relevant content delivered to you once a week