Change Healthcare Cyberattack Data Breach Litigation

In February 2024, the ALPHV/BlackCat ransomware group infiltrated Change Healthcare, a UnitedHealth Group subsidiary that processes approximately 15 billion healthcare transactions annually — roughly one-third of all U.S. patient records. The attackers exfiltrated an estimated 6 terabytes of data before deploying ransomware that took Change Healthcare's systems offline for weeks, causing catastrophic disruptions to prescription processing, insurance claims, and payment systems across virtually every corner of the U.S. healthcare industry. UnitedHealth Group reportedly paid a $22 million ransom. Affected data includes names, Social Security numbers, dates of birth, health insurance details, medical record numbers, diagnoses, treatment information, and financial/banking data for an estimated 190 million individuals — surpassing all prior U.S. healthcare breaches combined.

A federal MDL was established in the District of Minnesota in 2024, consolidating hundreds of lawsuits filed by patients, independent physicians, hospital systems, pharmacies, and healthcare providers who suffered financial losses and operational shutdowns due to the attack. Patient plaintiffs allege UnitedHealth Group failed to implement adequate cybersecurity safeguards required by HIPAA and industry standards, and that the company's acquisition of Change Healthcare in 2022 — which concentrated enormous amounts of health data within a single entity — created an irresistible and foreseeable target for cybercriminals. Provider plaintiffs, including small practices and rural hospitals, allege they lost millions in revenue while unable to submit or receive payment for claims during the outage. Congressional hearings in 2024 sharply criticized UnitedHealth CEO Andrew Witty over the breach, and the HHS Office for Civil Rights has launched a formal investigation.