UnitedHealth Group says the impact from the cyberattack last year at its Change Healthcare subsidiary is much wider than previously understood, affecting roughly 190 million patients — up from previous estimates of about 100 million people.
The updated tally extends the scope beyond what was previously described by company Chief Executive Andrew Witty, who suggested during congressional testimony in May that data for 1 in 3 Americans could be affected by the hack.
With the US population standing at about 341 million people, the breach is now thought to affect about 1 in 2 Americans.
Even before Friday, the incident was by far the largest breach currently showing on the federal website, which doesn’t show a 2015 breach at health insurer Anthem Inc. that affected data for about 79 million patients.
“Change Healthcare has determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million,“ UnitedHealth Group said in a statement issued Friday afternoon. ”The vast majority of those people have already been provided individual or substitute notice.”
The company added that it “is not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis.”
Eden Prairie-based UnitedHealth Group owns UnitedHealthcare, the nation’s largest health insurer, and a fast-growing division for health services called Optum, which acquired Change Healthcare for $13 billion in 2022.
Change Healthcare was involved in processing a large share of all health care claims and payments in the U.S. — roughly 15 billion health care transactions annually before the hack, affecting 1 in 3 patient records, according to federal officials.
To contain the threat from the cyberattack, UnitedHealth Group shut down Change Healthcare’s system for processing medical claims, which created financial problems for hospitals and clinics across the country. For a time, the outage also snarled pharmacy counters, with some patients saying they struggled to fill prescriptions.
Earlier this year, the federal government opened an investigation to determine if a breach of protected health information occurred and whether UnitedHealth Group and Change Healthcare were in compliance with federal privacy, security and breach notification rules.
In July, the company started sending letters to patients about the hack, saying information ranging from health conditions to Social Security numbers may have been accessed.
UnitedHealth Group says it has repaired the affected systems at Change Healthcare.
The Federal Trade Commission offers a range of advice for people affected by a data breach at IdentityTheft.gov/databreach. Credit bureaus such as Experian also offer detailed advice on how to respond.
UnitedHealth Group is offering complimentary credit monitoring and identity protection services through IDX. To enroll, people can use the link at changecybersupport.com or call toll-free 888-846-4705. For additional support from Change Healthcare, consumers can call toll-free 866-262-5342.
©2025 The Minnesota Star Tribune. Visit at startribune.com. Distributed by Tribune Content Agency, LLC.
