HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedMulti-Stage ChainPIIPHIHighActive

CHANGE HEALTHCARE INC.

bd_f798a925758041e0 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Apr 22, 2025

To disclose

—

Affected

264,407state residents only

Linked

2 filings

Confidence

68%

Full breach record for CHANGE HEALTHCARE INC. →7 incidents on file

Change Healthcare Inc. submitted a supplemental breach notification to the Rhode Island Attorney General on April 18, 2025, updating the count of mailed notices to RI residents to 264,407 as of April 8, 2025. The incident involves the compromise of Change Healthcare, a healthcare services provider, impacting patient PII and PHI. The filing notes the analysis is ongoing and the count is an interim estimate subject to change.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Apr 22, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Delaware State AGbd_2a5d29840e271b1a2025-04-18 · +4dCandidate

Name: WILMER CUTLER PICKERING HALE AND DORR LLP
norm: wilmer cutler pickering hale and dorr

Name: CHANGE HEALTHCARE INC.
norm: change healthcare
Domain: changehealthcare.com
Industry: healthcare
Industry: Healthcarellm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 264,407state-resident count only
Data types: PIIPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: PartnerFinancial
Regulator citations: Provided update to Rhode Island Office of the Attorney General
Initial access: supply_chain

During the incident: Provided notice under the Health Insurance Portability and Accountability Act (HIPAA) to the Department of Health and Human Services, Office for Civil Rights
Issued HIPAA media notice
Provided a substitute notice link for customers to post on their own websites
Mailed individual notice letters to addresses in Rhode Island
Undertaking extensive data review and substantial analysis
Coordinating with its customers
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Delaware State AGApr 18 · first

Rhode Island State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://riag.ri.gov/media/7461/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2025
Raw hash: f3f64c16311d24cdc18d8db55541c8fe6490ae0f50bf4282e5464024d4c3211d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWILMER CUTLER PICKERING HALE AND DORR LLP

Victim entityCHANGE HEALTHCARE INC.

IncidentThird-Party / Supply Chain

Stated responseProvided notice under the Health Insurance Portability and Accountability Act (HIPAA) to the Department of Health and Human Services, Office for Civil Rights

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceriag.ri.gov