UnitedHealthcare

Two findings, either of which would carry this row alone. First: the Change Healthcare attack on UnitedHealth's own subsidiary exposed the data of roughly 192.7 million people (Change's final August 2025 estimate) - the largest healthcare data breach ever recorded anywhere in the world, more than double Anthem's previous record, and equal to well over half the US population. Second, and worse in daily terms: a class action alleges UnitedHealth's nH Predict algorithm - acquired with naviHealth and built on a database of about six million patients - decided when elderly Medicare Advantage members should stop needing rehabilitation, with an alleged 90% reversal rate on appeal. Set that against the other number in the case: only about 0.2% of denied Medicare Advantage members appeal at all. A tool that loses nine out of ten fights, pointed at people who almost never fight. A Senate investigation (Permanent Subcommittee on Investigations majority staff report, Oct 2024) found UnitedHealthcare's prior-authorization denial rate for post-acute care rose from 10.9% in 2020 to 22.7% in 2022, a rise that coincided with the company's push to automate the review process.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Case status. Private litigation; the legal tier of its sources has not been assigned yet.

Primary source. www.hipaaguide.net/change-healthcare-data-breach/ — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual policyholder agreements.

Data sharing

CONFIRMED 2026 BREACH (reported to HHS June 5, 2026): initially reported as affecting 34,574 individuals, revised on June 19, 2026 to 37,384 (per breach trackers citing the HHS OCR breach portal) — specific data types not yet publicly detailed as of this research, though health-insurer breaches typically involve medical/claims information. SEPARATELY, UnitedHealthcare's SIBLING COMPANY Change Healthcare (both under parent UnitedHealth Group) suffered the MASSIVE 2024 ransomware breach already documented elsewhere in this tracker (CareFirst BlueCross BlueShield row, Insurance tab), which CareFirst itself sued over — meaning UnitedHealth Group's corporate family has now generated at least TWO separate, serious breach incidents referenced across this tracker.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (UNH). Service route: c/o General Counsel / Corporate Secretary, Eden Prairie, Minnesota — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.