Change Healthcare Data Breach Lawsuit: The 190 Million-Record Hack

What Happened

In February 2024, the ransomware group ALPHV (also called BlackCat) attacked Change Healthcare, a UnitedHealth Group unit that processes a huge share of US medical claims. The attackers got in through a remote-access system that lacked multi-factor authentication, and the intrusion crippled claims processing nationwide for weeks. UnitedHealth later confirmed the breach affected the data of roughly 190 million individuals — one of the largest health-data breaches ever — and said it paid a $22 million ransom.

The exposed information reportedly included medical records, test results, insurance details and Social Security numbers.

The Lawsuits

Two groups sued. Consumers brought class actions alleging UnitedHealth failed to protect their sensitive data, and healthcare providers — led by pharmacy groups — sued over the financial losses from the processing outage. The federal cases were consolidated into a single multidistrict litigation in Minnesota, where UnitedHealth is headquartered, to coordinate pretrial proceedings.

Data-breach class actions generally turn on whether the company’s security was unreasonable and whether plaintiffs suffered a concrete injury, such as identity theft or a real risk of it — the recurring battleground in these cases.

What Affected People Should Know

Given the scale, most Americans should assume some data may be involved. Practical steps: consider a credit freeze, watch for medical-identity-theft signs (unfamiliar bills or explanation-of-benefits entries), and use any free credit monitoring offered. For a claim, keep records of any fraud you can tie to the breach — that evidence is what gives an individual claim value beyond the class.