UNITEDHEALTH GROUP INCORPORATED

UnitedHealth Group filed 8-K/A Amendment No. 2 updating prior disclosures about the Change Healthcare cyberattack. The amendment incorporates an April 22, 2024 press release describing ongoing data assessment, support for impacted individuals, provider/customer notifications, and Change Healthcare service restoration progress. The underlying incident is the previously disclosed cyberattack on UnitedHealth Group subsidiary Change Healthcare.

Visits: 9992 Data Size: 4TB Published: False

Visits: 38 Data Size: 4TB Published: False

UnitedHealth Group filed an Amendment No. 1 to its February 22, 2024 Form 8-K disclosing that cybercrime threat actors had gained access to certain Change Healthcare IT systems. The Company isolated the impacted systems, notified customers, law enforcement and government agencies, and is investigating the extent of impacted data. The Company believes the issue is specific to Change Healthcare; all other systems remain operational. As of the amendment date, no material impact on financial condition or results of operations had been determined.

UnitedHealth Group's FY2023 10-K Item 1C briefly notes a cybersecurity incident disclosed on February 22, 2024, believed to have been committed by cybercrime threat actors. The company states the investigation is ongoing and that, as of the report date, it has not determined the incident is reasonably likely to materially impact its financial condition or results of operations. No technical details, affected individual count, data types, or attack vector are disclosed in this filing.

On February 21, 2024, UnitedHealth Group identified a suspected nation-state cyber threat actor that had gained access to certain Change Healthcare IT systems. The Company isolated the impacted systems, retained security experts, engaged law enforcement, and notified customers and government agencies. As of the filing, UnitedHealth had not determined the incident reasonably likely to materially impact financial condition or results of operations.

UNITED HEALTH GROUP filed a data-breach notice with the Illinois Attorney General during 2022 (case 2022-087). The register records the breach as discovered on May 5, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITED HEALTH GROUP filed a data-breach notice with the Illinois Attorney General during 2022 (case 2022-088). The register records the breach as discovered on August 16, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UnitedHealth Group Single Affiliated Covered Entity reported to HHS on 2021-07-30 a Unauthorized Access/Disclosure affecting 774 individuals. Breached information located on Network Server. A coding error caused PHI, including names and Social Security numbers, to appear on the patient portal. The entity provided complimentary credit monitoring and implemented additional safeguards.

UnitedHealth Group Health Plan Single Affiliated Covered Entity reported to HHS on 2020-02-04 a Hacking/IT Incident at a business associate affecting 3335 individuals. The compromised protected health information included names, treatment information, and claims and financial information from a network server. In response, the entity offered complimentary credit monitoring and implemented additional safeguards.

UnitedHealth Group Health Plan Single Affiliated Covered Entity reported to HHS on 2020-01-22 an Unauthorized Access/Disclosure affecting 934 individuals. Breached information located on Paper/Films. An employee inadvertently sent mail containing PHI (names, DOBs) to a plan member. CE provided credit monitoring and implemented administrative safeguards.

UnitedHealth Group Health Plan Single Affiliated Covered Entity reported to HHS on 2019-05-08 a Unauthorized Access/Disclosure affecting 20536 individuals. Breached information located on Network Server. The entity mistakenly filed the report regarding an incident at another CE; the case was closed without investigation.

UnitedHealth Group reported to HHS on 2018-04-10 a Unauthorized Access/Disclosure affecting 896 individuals. Breached information located on Paper/Films. An employee of a business associate mistakenly mailed PHI to wrong recipients.

UnitedHealth Group reported to HHS on 2018-03-15 a Unauthorized Access/Disclosure affecting 1755 individuals. Breached information located on Paper/Films. Enrollment packages containing PHI were incorrectly mailed to wrong recipients.

United Health Group Single Affiliated Covered Entity reported to HHS on 2016-11-22 a Hacking/IT Incident affecting 1408 individuals. Breached information located on Network Server. The ePHI involved included names, addresses, and claims and health insurance information. The CE implemented additional administrative, technical, and security safeguards.

United Health Group reported that members of its Louisiana Medicaid Plan had their names incorrectly matched with the wrong addresses, which resulted in letters containing protected health information being mailed to incorrect recipients. This breach affected approximately 5,330 individuals and involved their names, treatment information, and claims information.

UnitedHealth Group reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-09-26. 5 Massachusetts residents were affected. The report records the breach type as paper.

UnitedHealth Group health plan single affiliated covered entity (MN) reported to HHS OCR on 2012-05-18 an Unauthorized Access/Disclosure incident affecting 19,100 individuals. Breached information was located on Other media. No business associate was present. No further description was provided.

UnitedHealth Group reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-04-01. 34 Massachusetts residents were affected. The report records the breach type as electronic.

UnitedHealthcare discovered unauthorized employee access to a database containing personal information, including names, SSNs, and Medicare numbers, for the period June 28 to December 12, 2011. The incident was detected on January 30, 2012. Law enforcement was notified, and affected individuals were offered one year of credit monitoring. The company is reinforcing employee policies and evaluating additional safeguards.

UnitedHealth Group health plan single affiliated covered entity reported to HHS on 2012-02-01 a breach of type 'Other' affecting 6678 individuals. Breached information located on Paper/Films.

UnitedHealth Group (Health Plan, MN) reported to HHS OCR on 2010-06-04 a breach of type 'Other' affecting 16,291 individuals. Paper correspondence for members in UnitedHealth's prescription drug plans was inadvertently sent to incorrect temporary addresses due to a database administration error involving a third-party vendor (PDI) proprietary address database. Exposed data included member name, plan number, and in some cases date of birth and/or limited medical information. Breached information located on Paper/Films. UnitedHealth stopped using PDI's database and revised its address update process.

UnitedHealth Group reported to HHS on 2010-04-27 a Theft affecting 735 individuals. Breached information located on Other, Paper/Films. Remittance forms containing PHI were stolen.