FEDERALItem 7.01 · voluntary (Reg FD)HackingHealthcareHealthcareSupply Chain (3P Vendor)Data ExfiltratedPIIFinancial accountLowActive

Change Healthcare

bd_ceefcf273bc5de75 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 14, 2024

To disclose

—

Affected

Not disclosed

Confidence

68%

Option Care Health, Inc. filed an 8-K disclosing that Change Healthcare, a subsidiary of UnitedHealth Group, experienced a cybersecurity incident on February 21, 2024. Option Care Health disconnected from Change Healthcare's systems on that date and has not identified any compromise of its own systems. The incident caused operational disruptions, preventing the processing of over half of the Company's claims, impacting cash flow and patient care operations.

P pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

Mar 14, 2024

Filed

Name: OPTION CARE HEALTH, INC.
norm: option care health
SEC CIK: 0001014739
Domain: optioncare.com

Name: Change Healthcare
norm: change healthcare
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: Mar 14, 2024
Notification sent: Mar 14, 2024
Affected individuals: Not disclosed
Data types: PIIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Change Healthcare
Initial access: supply_chain

During the incident: Disconnected its operations from Change Healthcare applications
Working continuously to find alternative processes to help maintain patient care and its overall operations
Deployed alternative platforms and applications
Established workarounds where practicable
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1014739/000101473924000013/bios-20240314.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 14, 2024
Raw hash: 797991bd944ebc1bb5d5f66da93bbd24cdc31dbe4684ef6180240d3afd3017ca

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html28.6 KB

Download View at source

Reporting entityOPTION CARE HEALTH, INC.

Victim entityChange Healthcare

IncidentThird-Party / Supply Chain

Stated responseDisconnected its operations from Change Healthcare applications

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing