UnitedHealth Group / Optum Data Breach Litigation

In February 2024, the ALPHV/BlackCat ransomware gang infiltrated Change Healthcare, a subsidiary of UnitedHealth Group's Optum division that processes roughly one-third of all U.S. medical claims. The attackers exfiltrated an estimated 6 terabytes of sensitive data before deploying ransomware that knocked critical payment and claims-processing systems offline for weeks, disrupting care at hospitals, pharmacies, and clinics nationwide. UnitedHealth later confirmed that approximately 190 million individuals had their protected health information (PHI), Social Security numbers, insurance details, and financial data compromised — more than double the original estimate — cementing it as the largest healthcare data breach in American history.

Dozens of class action lawsuits were filed in federal courts across the country and consolidated in the District of Minnesota. Plaintiffs allege UnitedHealth Group and Optum failed to implement basic multi-factor authentication and other reasonable cybersecurity safeguards required under HIPAA and state consumer-protection laws. The litigation seeks damages for identity theft exposure, out-of-pocket losses, and the cost of ongoing credit monitoring. Congressional hearings were held, UnitedHealth CEO Andrew Witty testified before the Senate, and the company has confirmed paying a $22 million ransom. The case remains in active discovery as of mid-2025.