UnitedHealth Group / Change Healthcare Data Breach Class Action

In February 2024, the ALPHV/BlackCat ransomware group launched a devastating cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group that processes roughly one-third of all U.S. healthcare transactions. The breach — which UnitedHealth confirmed exposed data belonging to approximately 190 million individuals — is believed to be the largest healthcare data breach in U.S. history, surpassing the 2015 Anthem hack. Stolen information included Social Security numbers, dates of birth, health insurance member IDs, diagnosis codes, medication records, and banking information. The attack also disrupted prescription drug processing and insurance claims across thousands of hospitals, pharmacies, and physician practices for weeks, causing widespread harm to patients who could not access medications or reimbursements.

Class action lawsuits were filed within days of the breach disclosure, alleging that UnitedHealth Group and Change Healthcare failed to implement adequate cybersecurity measures despite handling extraordinarily sensitive data for the majority of the American public. Plaintiffs assert claims under the Health Insurance Portability and Accountability Act (HIPAA), state consumer protection laws, negligence, and breach of contract. The U.S. Senate held hearings in which CEO Andrew Witty testified, and UnitedHealth paid a $22 million ransom. Litigation remains active with dozens of consolidated cases pending in the District of Minnesota, and regulators including HHS OCR have launched parallel investigations that may inform settlement negotiations.