Change Healthcare (Optum / UnitedHealth Group)

The largest health-data breach on record in the US. In February 2024 a ransomware group got into Change Healthcare, the claims clearinghouse that a huge share of US doctors, pharmacies and insurers route bills and eligibility checks through. They got in with stolen credentials through a remote-access (Citrix) portal that, by UnitedHealth's CEO's own testimony, did not have multi-factor authentication. UnitedHealth paid a $22 million ransom. The final count reported to HHS's Office for Civil Rights was about 192.7 million people (July 31, 2025), and UnitedHealth said it couldn't fully de-duplicate that number. HHS OCR has open investigations of both Change Healthcare and UnitedHealth Group, with no findings published yet. Nebraska's Attorney General became the first state to sue, in December 2024. A judge denied the companies' motion to dismiss in November 2025, so that case is going forward. Roughly 50 private class actions are consolidated in federal court in Minnesota (MDL No. 3108). No settlement had been announced as of mid-2026. Most people whose data was taken never chose to do business with Change Healthcare. Their doctor, pharmacy or insurer sent their records through it.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-15

Primary source. www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/ — Unverified - heuristic first draft.

Arbitration

None. There is no consumer contract, because patients have no direct agreement with Change Healthcare. The website privacy notice says continued use of the Sites or Services 'constitutes your consent' to notice changes.

Data sharing

Acts as a HIPAA business associate for providers and payers. Its own privacy notice says its handling of protected health information 'is guided by HIPAA and the terms of a business associate agreement' and isn't described in the public notice. Claims, eligibility, pharmacy and payment transactions for a very large share of US patients flow through it. Data reported as exposed in the breach included medical, personal and financial information (Nebraska AG). The website privacy notice also lists collecting 'inferences' and data from data brokers, credit agencies and social networks about website and service users, which is separate from patient PHI.

Contacts

Privacy contact. privacy@optum.com

Legal notice. Privacy mail: Optum Privacy Office, MN101-E013, 11000 Optum Circle, Eden Prairie, MN 55344 (per Change Healthcare privacy notice). UnitedHealth Group Incorporated, a Delaware corporation, lists principal executive offices at 1 Health Drive, Eden Prairie, MN 55344 and 655 New York Avenue NW, Washington, DC 20001 (FY2025 Form 10-K cover, filed Mar. 2, 2026). For service of process, confirm the Delaware registered agent via the Delaware Division of Corporations (not checked this pass).

Mailing address. Not recorded.