Change Healthcare now estimates that 190 million people were affected in the massive cyberattack that took down its services nearly a year ago.
UnitedHealth Group, Change’s parent company, said in a statement to Fierce Healthcare that the “vast majority” of people impacted have received an individual or substitute notice about the breach. The healthcare giant said the number will be confirmed and filed with the Department of Health and Human Services’ Office for Civil Rights (OCR) “at a later date.”
“Change Healthcare is not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis,” according to the statement.
In a previous estimate, filed with the OCR in October, Change projected that 100 million people were affected by the breach. UnitedHealth Group CEO Andrew Witty told legislators last summer during a hearing on the cyberattack that a third of Americans likely were impacted.
In an update filed to its website earlier this month, Change said it has notified the affected customers for which it has an address on file. It did note that it “may not have sufficient addresses for all potentially impacted individuals.” It said it does not anticipate identifying additional customers that were impacted.
Change’s systems were breached in February 2024 by a hacking gang operating as ALPHV or BlackCat. The hackers breached a server that did not have two-factor authentication enabled using stolen credentials and moved within the system for several days exfiltrating data before deploying ransomware.
UnitedHealth filed an initial breach notification in July, though the sheer scale of the breach made the data analysis a lengthy process. UHG began the notification process last June, reaching out to organizations with members or patients who may have been affected.
The cyberattack posed a significant financial cost to UnitedHealth, with the company projecting that it would take a $2.9 billion hit.
Individuals who were impacted by the breach can access free credit monitoring provided by UnitedHealthcare here.
Publisher: Source link
