Change Healthcare data breach: what happened and what to do

Change Healthcare is a UnitedHealth Group company that moves insurance claims and payments between doctors, hospitals, pharmacies and insurers. Most people have never heard of it, yet its systems touched records of a large share of the US population. That is why a cyberattack in February 2024 produced the biggest health data breach on record.

What happened

Change Healthcare was hit by a cyberattack in February 2024, which disrupted claims processing and pharmacy payments nationwide for weeks. In July 2024 it filed an initial report with the US Department of Health and Human Services' Office for Civil Rights (OCR) listing 500 people as a placeholder while the work continued. On July 31, 2025, the total was updated to approximately 192.7 million people. UnitedHealth Group said the total likely includes duplicates, so it is not necessarily the number of unique individuals, and that state-level counts vary.

Letters went out on a rolling basis starting in late July 2024. People without a usable mailing address were pointed to a substitute notice on its website, posted from June 20, 2024. OCR said it continues to investigate Change Healthcare's and UnitedHealth Group's HIPAA compliance.

What was exposed

The data varied by person. According to the HHS and UnitedHealth Group FAQs and press coverage, it could include:

• Contact details such as names and addresses
• Dates of birth
• Health insurance information, including member IDs
• Health information, such as diagnoses and treatment information
• Billing and claims records
• Social Security numbers, for some people

UnitedHealth Group said Social Security numbers weren't involved for most people, and that financial information, payment cards and driver's license numbers were rarely involved.

What that lets criminals do

Health data is valuable for a different reason than a password is. Criminals use insurance IDs and diagnoses for medical identity theft, such as billing in your name or getting prescriptions. Details about a condition or treatment make phishing and extortion attempts believable. A date of birth and address, combined with a Social Security number where present, are the basics for opening credit in your name.

What the company offered

Change Healthcare set up a call center and offered two years of free credit monitoring and identity theft protection to anyone who thought they might be affected. UnitedHealth Group also said it had notified the final round of impacted customers and doesn't expect to identify more.

What to do now

If you got a letter, use the monitoring and keep the letter with your records. Review your explanation of benefits statements for care you didn't receive: these are the statements your insurer sends after each claim, and a visit, prescription or provider you don't recognize is the earliest sign that someone is using your member ID. Check them for the next year or two, not just this month. If a Social Security number was involved, freeze your credit.