CHANGE HEALTHCARE INC.

Change Healthcare Inc. based in Eden Prairie, Minnesota, a other entity reported a data breach to the Texas Attorney General. The breach was discovered on 2024-03-13 and reported on 2025-10-14. 11,331,028 Texas residents were affected. 192,700,000 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via Posted at company website or special website;U.S. Mail.

Change Healthcare, a healthcare clearinghouse and subsidiary of UnitedHealth Group, disclosed a supplemental breach notification to the New Hampshire Attorney General on July 31, 2025. The incident involved unauthorized access to computer systems between February 17-20, 2024, detected on February 21, 2024. Approximately 192.7 million individuals were potentially impacted nationwide, including 655,282 New Hampshire residents. Data accessed included PII, PHI, and financial information. Change Healthcare engaged law enforcement, isolated systems, and provided credit monitoring services.

Change Healthcare reported a data breach to the Oregon Attorney General. The breach was reported on 2024-09-16. The breach occurred during 2/17/2024 - 2/20/2024. The breach was discovered on 2/21/2024. Notice was sent on 9/16/2024.

Change Healthcare Inc. disclosed a data breach where a cybercriminal accessed its computer system without permission between February 17 and February 20, 2024. The unauthorized access was detected on February 21, 2024. The incident involved the exfiltration of protected health information (PHI), including medical records, diagnoses, and treatments, as well as personally identifiable information (PII) such as names, addresses, Social Security numbers, and financial data including payment cards and bank account numbers. Change Healthcare contained the incident by shutting down systems, engaged law enforcement and forensic investigators, and is offering two years of credit monitoring and identity theft protection to affected individuals.

Change Healthcare Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2024-08-03. The breach occurred during 2/12/2024 - 2/22/2024. The breach was discovered on 3/13/2024. 250 individuals were affected. Notice was sent on 7/29/2024.

Change Healthcare Inc., a health sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2024-02-21 and filed notice on 2024-08-03. 3,121,209 Washington residents were affected. 164 days elapsed between awareness and notification. 4 days to identify the breach. 0 days to contain the breach.

Change Healthcare Inc. reported a data breach to the Montana Attorney General. The breach was reported on 2024-08-02. The breach occurred from 2/17/2024 to 2/20/2024. 346,718 Montana residents were affected.

Change Healthcare Inc. (CHC), a healthcare technology business associate, disclosed a ransomware incident. On Feb 12, 2024, attackers used compromised credentials to access a Citrix portal. Ransomware was deployed on Feb 21, 2024. Data exfiltration occurred Feb 17-20. CHC notified the NH AG on Aug 2, 2024. Impacted data includes PHI and PII. CHC provided credit monitoring and engaged forensic experts.

Change Healthcare disclosed a data breach where a cybercriminal accessed its computer system between Feb 17-20, 2024. The incident involved unauthorized access and exfiltration of data including contact info, health insurance data, health data, billing/payment data, and government IDs. CHC notified law enforcement, engaged a special team, and offered 2 years of free credit monitoring.

Change Healthcare, Inc. reported to HHS on 2024-07-19 a Hacking/IT Incident affecting 192,700,000 individuals. Breached information located on Network Server. Business Associate present.

Change Healthcare (CHC) a unit of UnitedHealthcare Group (UHG) reported a data breach to the Wisconsin DATCP. The public was notified on 2024-06-20. The incident occurred on February 17-20, 2024. Data accessed: May have included contact information (such as first and last name, address, date of birth, phone number, and email) and one or more of the following:.

UnitedHealth Group filed 8-K/A Amendment No. 2 updating prior disclosures about the Change Healthcare cyberattack. The amendment incorporates an April 22, 2024 press release describing ongoing data assessment, support for impacted individuals, provider/customer notifications, and Change Healthcare service restoration progress. The underlying incident is the previously disclosed cyberattack on UnitedHealth Group subsidiary Change Healthcare.

Option Care Health, Inc. filed an 8-K disclosing that Change Healthcare, a subsidiary of UnitedHealth Group, experienced a cybersecurity incident on February 21, 2024. Option Care Health disconnected from Change Healthcare's systems on that date and has not identified any compromise of its own systems. The incident caused operational disruptions, preventing the processing of over half of the Company's claims, impacting cash flow and patient care operations.

Bioventus (reporting entity) disclosed in its 10-K Item 1C that Change Healthcare (victim/third-party vendor) experienced a cybersecurity incident where a threat actor gained access to its IT systems. Bioventus states the incident has not materially affected its financial condition, though patient billing and claims processing were disrupted. Bioventus identified an alternative intermediary and resumed some submissions. UnitedHealth Group (Change Healthcare's parent) was investigating as of March 7, 2024.

UnitedHealth Group filed an Amendment No. 1 to its February 22, 2024 Form 8-K disclosing that cybercrime threat actors had gained access to certain Change Healthcare IT systems. The Company isolated the impacted systems, notified customers, law enforcement and government agencies, and is investigating the extent of impacted data. The Company believes the issue is specific to Change Healthcare; all other systems remain operational. As of the amendment date, no material impact on financial condition or results of operations had been determined.

On February 21, 2024, UnitedHealth Group identified a suspected nation-state cyber threat actor that had gained access to certain Change Healthcare IT systems. The Company isolated the impacted systems, retained security experts, engaged law enforcement, and notified customers and government agencies. As of the filing, UnitedHealth had not determined the incident reasonably likely to materially impact financial condition or results of operations.

Change Healthcare reported to HHS on 2022-07-07 a Unauthorized Access/Disclosure affecting 1262 individuals. Breached information located on Paper/Films. The business associate, Change Healthcare Technologies, experienced a software issue that caused PHI (names, claims, financial, and treatment info) to be sent to wrong recipients. HHS and individuals were notified; additional technical safeguards were implemented.