UnitedHealth Change Healthcare Breach: Ransomware Disrupts US Healthcare System

Change Healthcare, a subsidiary of UnitedHealth Group that processes approximately one-third of all US healthcare transactions, suffered a devastating ransomware attack by the BlackCat/ALPHV group that disrupted healthcare operations nationwide for weeks. The breach potentially exposed protected health information for over 100 million Americans, making it the largest healthcare data breach in US history. The attack disrupted pharmacy operations, delayed insurance claims processing, and left healthcare providers unable to verify patient coverage or submit claims. UnitedHealth reportedly paid a $22 million ransom to the attackers. The breach revealed that Change Healthcare lacked multi-factor authentication on critical systems and had not implemented adequate network segmentation. Congressional hearings examined how the consolidation of healthcare IT infrastructure into a single company created a systemic vulnerability. The incident exposed the fragility of centralized healthcare data systems and the cascading effects when a dominant processor fails.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.