Data Breach at Change Healthcare May Have Impacted Up To 190M Patients’ Records: Report

UnitedHealth Group reports that nearly twice the number of patients were affected by a cybersecurity breach at its Change Healthcare subsidiary than originally believed, bringing the total number of individuals whose personal and health data were compromised by hackers to about 190 million.

The Change Healthcare data breach was originally announced almost a year ago, in February 2024, when the company reported that hackers had gained access to the names, Social Security numbers, dates of birth, addresses, medical records, insurance details and other sensitive data for millions of individuals.

While Change Healthcare is not well known among most U.S. consumers, it provides critical software, analytics and services for medical providers throughout the healthcare system. Some estimates suggest that one out of every three Americans has their private health information pass through the company’s servers.

Since the data breach was first announced there has been an influx of Change Healthcare data breach class action lawsuits filed throughout the federal court system, each raising similar allegations that cybersecurity failures allowed hackers to access personal identifying and medical information.

In addition, Change Healthcare and UnitedHealth face numerous additional lawsuits filed by medical facilities nationwide, who were unable to process claims after the incident, causing severe business disruptions and an inability to serve patients.

Originally estimated to impact about 100 million patients, the parent company reported in January that it now believes 90 million more people were affected than previously estimated. That accounts for more than half of the U.S. population and is the largest health industry data breach ever recorded.

The updated numbers were submitted in a report to the Department of Health and Human Services’ Office of Civil Rights, according to various media reports.

The new numbers could mean far more potential claims could be filed in the coming months and years, and the class action lawsuits already submitted could represent a much larger class than first anticipated as individuals continue to receive Change Healthcare notices about the data breach on a rolling basis.

Change Healthcare Data Breach Lawsuits

Given common questions of fact and law raised in the claims, a federal multidistrict litigation (MDL) has been established in the District of Minnesota, where U.S. District Judge Donovan Frank is presiding over coordinated discovery and pretrial proceedings.

Judge Frank has already ordered the parties to begin exploring the possibility of Change Healthcare data breach settlement talks. As part of the hope of a swift resolution to the litigation, on January 27 he sent a letter (PDF) to several state judges, who have also received Change Healthcare data breach lawsuits, inviting them to listen in on the next status conference for the federal litigation, which is scheduled for February 4.

The letter was sent to judges in Tennessee, New Jersey, Florida, Washington State, California, Texas and Nebraska, who, presumably, all have Change Healthcare lawsuits filed in their courts.