UnitedHealth Hack Exposed Health Data of 100 Million People

In February, Change Healthcare, a tech company owned by UnitedHealth Group (UHG), underwent a massive cyberattack that involved paying a $22 million ransom to resolve.

On Thursday, UHG quantified the number of people affected by the attack for the first time, eight months after the breach happened. A new filing in the U.S. Department of Health and Human Services portal on Thursday shows that one-third of the U.S. population, or about 100 million Americans, had their data stolen during the breach.

The cyberattack exposed sensitive health records, like medical diagnoses, test results, medications, and health plans, as well as Social Security numbers and other personally identifiable information.

Related: UnitedHealth Paid Ransom to Cyberhackers After Patients’ Personal Data Was Compromised

The scope of the attack makes it the largest healthcare data breach ever, surpassing an Anthem incident in 2015 that affected almost 79 million Americans.

According to a testimony given by UHG CEO Andrew Witty before the House Energy and Commerce Committee, the data breach happened when “criminals used compromised credentials” to get into a Change healthcare portal that did not have multi-factor authentication enabled. Change handles payment processing for 15 billion medical claims per year or about 40% of all claims; UHG acquired it in late 2022.

^{UHG CEO Andrew Witty. Photo Credit: Tom Williams/CQ-Roll Call, Inc via Getty Images}

The cyberattack disrupted daily life — some medical providers, hospitals, and pharmacies were unable to fulfill patient prescriptions and process billing for patients for weeks after it happened.

The U.S. is experiencing an overall increase in data breaches. The nonprofit Identity Theft Resource Center says there has been a 72% rise in incidents from 2021 to 2023.

Related: A Cyberattack on the Largest Health Insurer in the U.S. Could Put Your Prescriptions and Personal Data at Risk