HackingHealthcareTechnologyHealthcareVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedDownstream VictimsDelayed DiscoveryPIIIdentity (basic)Government IDFinancial accountFinancial credentialsPHIHealth (basic)CriticalContained

CHANGE HEALTHCARE INC.

bd_f6ce723161ae67cf · schema v1 · pii pii-v1

Severity

Critical

Discovered

Feb 21, 2024

Filed

Jul 31, 2025

To disclose

18 months

Affected · nationwide

192,700,000655,282 in this filing

Linked

2 filings

Confidence

64%

Full breach record for CHANGE HEALTHCARE INC. →7 incidents on file

Change Healthcare, a healthcare clearinghouse and subsidiary of UnitedHealth Group, disclosed a supplemental breach notification to the New Hampshire Attorney General on July 31, 2025. The incident involved unauthorized access to computer systems between February 17-20, 2024, detected on February 21, 2024. Approximately 192.7 million individuals were potentially impacted nationwide, including 655,282 New Hampshire residents. Data accessed included PII, PHI, and financial information. Change Healthcare engaged law enforcement, isolated systems, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 18 months / 526 days

Feb 17, 2024

Begins

Feb 21, 2024

Discovered

Jul 31, 2025

Filed

vs. sector median

+63 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Delaware State AGbd_1f98946b9f90517c2025-07-31Verified

Name: CHANGE HEALTHCARE INC.
norm: change healthcare
Domain: changehealthcare.com

Name: CHANGE HEALTHCARE INC.
norm: change healthcare
Domain: changehealthcare.com
Industry: HealthcarellmTechnologyllm

Discovered: Feb 21, 2024
Breach occurred: Feb 17, 2024 – Feb 20, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 20, 2024
Affected individuals: 192,700,000state + nationwide
Data types: PIIIdentity (basic)Government IDFinancial accountFinancial credentialsPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified NH Attorney General Consumer Protection Division
Initial access: exploit_public_facing

During the incident: Hired a special team to help us
Called law enforcement
Turned off CHC’s systems to help protect our business customers and their individuals
Offering free credit monitoring and identity theft protection services
Changes made: Making our computer systems even stronger than before
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(526 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Delaware State AGJul 31 · first

New Hampshire State AGJul 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/change-healthcare-20250731.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2025
Raw hash: bd52c9d6bf4cce50ba4ab11b1d871d976026809ea532ae5a1fb64ef16f21a719

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCHANGE HEALTHCARE INC.

Victim entityCHANGE HEALTHCARE INC.

Incidentdiscovered Feb 21, 2024

Stated responseHired a special team to help us

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov