Change Healthcare
Disclosed Feb 22, 20242 years ago192,700,000 affectedConfirmed
Ransomware attack on Change Healthcare exposes data of about 190 million people
UnitedHealth Group disclosed in an SEC filing that an attacker had accessed Change Healthcare systems on February 21, 2024, disrupting claims and pharmacy payments nationwide. The ALPHV/BlackCat attack exposed contact, insurance, health and billing data of about 190 million people, and UnitedHealth confirmed paying a $22 million ransom.
What is known
| People affected | 192,700,000 (as reported by the organization) |
|---|---|
| Disclosed | Feb 22, 2024 |
| Discovered | Feb 21, 2024 |
| Happened | Feb 12, 2024 |
| Attack | Ransomware |
| Data exposed | Names, Addresses, Phone numbers, Health, Insurance, Financial, Social Security numbers, Government IDs, Payment cards, Dates of birth |
| Sector | Healthcare · US |
| Status | Confirmed |
| Lawsuit or fine | Consolidated class actions in Minnesota federal court; Nebraska attorney general lawsuit (Dec 2024); HHS OCR investigation opened March 2024 |
Sources
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Feb 22, 2024 | 190,000,000 |
| HHS archivetotal | Jul 19, 2024 | 192,700,000 |
| Vermont AGresidents of VT | Jul 29, 2024 | |
| California AGresidents of CA | Aug 3, 2024 | |
| Washington AGresidents of WA | Aug 3, 2024 | 3,121,209 |
| Oregon DOJresidents of OR | Aug 3, 2024 | 250 |
| Oregon DOJresidents of OR | Sep 16, 2024 | |
| Delaware DOJresidents of DE | Apr 18, 2025 | 539,916 |
| Delaware DOJresidents of DE | Jul 31, 2025 | 534,372 |
| Texas AGresidents of TX | Oct 14, 2025 | 11,331,028 |
Other breaches at Change Healthcare
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jul 7, 2022Jul 7, 20224 years agoInsider | Jul 7, 20224 years ago | Insider | Healthcare | Confirmed | 1,262 |
History of this record
- 2026-09-25 · source: empty to https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-07-29-change-healthcare-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: ["names","addresses","phone","health","insurance","financial"] to ["names","addresses","phone","health","insurance","financial","ssn","government-id","payment-card","dob"] · backfill source
- 2026-09-25 · records: 190000000 to 192700000 · backfill source
- 2026-09-25 · lawsuit: empty to Consolidated class actions in Minnesota federal court; Nebraska attorney general lawsuit (Dec 2024); HHS OCR investigation opened March 2024 · seed source
- 2026-09-25 · data_types: ["names"] to ["names","addresses","phone","health","insurance","financial"] · seed source
- 2026-09-25 · records: 192700000 to 190000000 · seed source
- 2026-09-25 · disclosed: 2024-08-03 to 2024-02-22 · seed source
- 2026-09-25 · summary: empty to UnitedHealth Group disclosed in an SEC filing that an attacker had accessed Change Healthcare systems on February 21, 2024, disrupting claims and pharmacy payments nationwide. The ALPHV/BlackCat attack exposed contact, insurance, health and · seed source
- 2026-09-25 · title: empty to Ransomware attack on Change Healthcare exposes data of about 190 million people · seed source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 192700000 · backfill source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2024-02-21 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.