UnitedHealth Group Incorporated

UnitedHealth Group (UNH) filed its 10-K Item 1C disclosing no material cybersecurity risks as of Dec 31, 2025. The filing details a comprehensive cybersecurity program aligned with NIST, including risk assessments, incident response, third-party risk management, and board oversight by the Audit and Finance Committee. No specific breaches or incidents were reported.

UnitedHealth Group filed 8-K/A Amendment No. 2 updating prior disclosures about the Change Healthcare cyberattack. The amendment incorporates an April 22, 2024 press release describing ongoing data assessment, support for impacted individuals, provider/customer notifications, and Change Healthcare service restoration progress. The underlying incident is the previously disclosed cyberattack on UnitedHealth Group subsidiary Change Healthcare.

UnitedHealth Group filed an Amendment No. 1 to its February 22, 2024 Form 8-K disclosing that cybercrime threat actors had gained access to certain Change Healthcare IT systems. The Company isolated the impacted systems, notified customers, law enforcement and government agencies, and is investigating the extent of impacted data. The Company believes the issue is specific to Change Healthcare; all other systems remain operational. As of the amendment date, no material impact on financial condition or results of operations had been determined.

UnitedHealth Group's FY2023 10-K Item 1C briefly notes a cybersecurity incident disclosed on February 22, 2024, believed to have been committed by cybercrime threat actors. The company states the investigation is ongoing and that, as of the report date, it has not determined the incident is reasonably likely to materially impact its financial condition or results of operations. No technical details, affected individual count, data types, or attack vector are disclosed in this filing.

On February 21, 2024, UnitedHealth Group identified a suspected nation-state cyber threat actor that had gained access to certain Change Healthcare IT systems. The Company isolated the impacted systems, retained security experts, engaged law enforcement, and notified customers and government agencies. As of the filing, UnitedHealth had not determined the incident reasonably likely to materially impact financial condition or results of operations.

UnitedHealth Group Single Affiliated Covered Entity reported to HHS on 2021-07-30 a Unauthorized Access/Disclosure affecting 774 individuals. Breached information located on Network Server. A coding error caused PHI, including names and Social Security numbers, to appear on the patient portal. The entity provided complimentary credit monitoring and implemented additional safeguards.

UnitedHealth Group Health Plan Single Affiliated Covered Entity reported to HHS on 2020-02-04 a Hacking/IT Incident at a business associate affecting 3335 individuals. The compromised protected health information included names, treatment information, and claims and financial information from a network server. In response, the entity offered complimentary credit monitoring and implemented additional safeguards.

UnitedHealth Group Health Plan Single Affiliated Covered Entity reported to HHS on 2019-05-08 a Unauthorized Access/Disclosure affecting 20536 individuals. Breached information located on Network Server. The entity mistakenly filed the report regarding an incident at another CE; the case was closed without investigation.

United Health Group Single Affiliated Covered Entity reported to HHS on 2016-11-22 a Hacking/IT Incident affecting 1408 individuals. Breached information located on Network Server. The ePHI involved included names, addresses, and claims and health insurance information. The CE implemented additional administrative, technical, and security safeguards.

United Health Group reported that members of its Louisiana Medicaid Plan had their names incorrectly matched with the wrong addresses, which resulted in letters containing protected health information being mailed to incorrect recipients. This breach affected approximately 5,330 individuals and involved their names, treatment information, and claims information.

UnitedHealth Group health plan single affiliated covered entity (MN) reported to HHS OCR on 2012-05-18 an Unauthorized Access/Disclosure incident affecting 19,100 individuals. Breached information was located on Other media. No business associate was present. No further description was provided.

UnitedHealth Group health plan single affiliated covered entity experienced unauthorized internal access to a database between June 28 and December 12, 2011. Discovered on January 30, 2012, the incident exposed member PII (name, SSN, DOB, address, Medicare ID). The company investigated, reported to law enforcement, and offered one year of Equifax credit monitoring. Remediation included reinforcing employee policies and evaluating additional safeguards.

UnitedHealth Group health plan single affiliated covered entity reported to HHS on 2012-02-01 a breach of type 'Other' affecting 6678 individuals. Breached information located on Paper/Films.

UnitedHealth Group (Health Plan, MN) reported to HHS OCR on 2010-06-04 a breach of type 'Other' affecting 16,291 individuals. Paper correspondence for members in UnitedHealth's prescription drug plans was inadvertently sent to incorrect temporary addresses due to a database administration error involving a third-party vendor (PDI) proprietary address database. Exposed data included member name, plan number, and in some cases date of birth and/or limited medical information. Breached information located on Paper/Films. UnitedHealth stopped using PDI's database and revised its address update process.