CHANGE HEALTHCARE INC.
bd_f6ce723161ae67cf · schema v1 · pii pii-v1
Full breach record for CHANGE HEALTHCARE INC. →Change Healthcare, a healthcare clearinghouse and subsidiary of UnitedHealth Group, disclosed a supplemental breach notification to the New Hampshire Attorney General on July 31, 2025. The incident involved unauthorized access to computer systems between February 17-20, 2024, detected on February 21, 2024. Approximately 192.7 million individuals were potentially impacted nationwide, including 655,282 New Hampshire residents. Data accessed included PII, PHI, and financial information. Change Healthcare engaged law enforcement, isolated systems, and provided credit monitoring services.
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/change-healthcare-20250731.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 31, 2025
- Raw hash
- bd52c9d6bf4cce50ba4ab11b1d871d976026809ea532ae5a1fb64ef16f21a719
Reporting entity
- Name
- CHANGE HEALTHCARE INC.norm: change healthcare
- Domain
- changehealthcare.com
Victim entity
- Name
- CHANGE HEALTHCARE INC.norm: change healthcare
- Domain
- changehealthcare.com
Incident
- Discovered
- Feb 21, 2024
- Materiality determined
- —
- Notification sent
- Jun 20, 2024
- Affected individuals
- 192,700,000
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSPHIHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified NH Attorney General Consumer Protection Division
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 18 months(526 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.