UNITEDHEALTHCARE INSURANCE COMPANY

United Language Group, LLC, a third-party vendor for UnitedHealthcare, detected unauthorized access to its network on July 9, 2025. An attacker accessed data between July 8-9, 2025. Affected data included PHI, PII, government IDs, and limited financial account info. One Rhode Island resident was notified. ULC engaged forensic investigators and is offering 24 months of credit monitoring.

UnitedHealthcare reported to HHS on 2025-08-12 a Unauthorized Access/Disclosure affecting 3215 individuals. Breached information located on Paper/Films.

Unitedhealthcare ("UHC") reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-04-25. 220 Massachusetts residents were affected.

UNITED HEALTHCARE INSURANCE COMPANY filed a data-breach notice with the Illinois Attorney General in February 2025 (case 25-02-125). The register records the breach as discovered on November 6, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITED HEALTHCARE INSURANCE COMPANY filed a data-breach notice with the Illinois Attorney General in February 2025 (case 25-02-072). The register records the breach as discovered on April 26, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UnitedHealthcare reported a data breach to the Indiana Attorney General. The breach occurred on 2024-02-14 and was reported on 2024-08-07. 2 Indiana residents were affected. 1,178 individuals affected in total.

UnitedHealthcare reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-08-06. 10 Massachusetts residents were affected.

UnitedHealthcare Insurance Company reported to HHS on 2024-05-01 an Unauthorized Access/Disclosure affecting 16,665 individuals. An employee of the covered entity's business associate mailed PHI of 16,665 individuals to the wrong recipients. Breached information was located in Paper/Films. The CE notified HHS, affected individuals, and media. The CE and BA implemented additional administrative, technical, and security safeguards, and staff were retrained.

Welltok, Inc. notified UnitedHealthcare members in Delaware of a data breach involving the exploitation of a zero-day vulnerability in Progress Software's MOVEit Transfer tool. The incident occurred between May 30-31, 2023, resulting in the exfiltration of member data including names, addresses, Member IDs, DOBs, and Medicaid IDs. Welltok engaged third-party forensic specialists and is offering 24 months of credit monitoring via Experian.

UnitedHealthcare Insurance Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-12-14. 61 Massachusetts residents were affected. The report records the breach type as electronic.

UnitedHealthcare notified Montana residents of a data breach involving unauthorized access to an Equality Health employee's email account. The incident resulted from an insider error where a UHC employee improperly sent member PII (including SSN, DOB, and Medicare info) to Equality Health in September 2020. The unauthorized access occurred in April 2023. UHC is offering credit monitoring and fraud assistance.

UnitedHealthcare reported a data breach to the Delaware Attorney General. The breach occurred on 2023-05-30. Notice was filed on 2023-09-22. 470 Delaware residents were affected.

UnitedHealthcare discovered unauthorized access to its broker portal on December 29, 2022. The incident occurred between December 1, 2022, and January 25, 2023. An unauthorized party accessed member health information, including names, member IDs, and plan details, while attempting to divert funds. Social Security numbers and financial account information were not involved. UnitedHealthcare disabled affected accounts and implemented additional security controls.

UnitedHealthcare reported a data breach to the Oregon Attorney General. The breach was reported on 2023-08-31. The breach occurred during 1/1/0001. The breach was discovered on 12/29/2022. 315,915 individuals were affected. Notice was sent on 1/1/0001.

UnitedHealthcare reported an unauthorized access incident affecting 18,418 Washington residents. The breach occurred between Dec 1, 2022, and Jan 25, 2023, and was discovered on Dec 29, 2022. The attacker accessed the UHC broker portal to divert funds, exposing member names, IDs, and plan details. Law enforcement was notified, and a Secret Service delay on notification was lifted in Aug 2023.

UnitedHealthcare reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-25. 19,910 Massachusetts residents were affected. The report records the breach type as electronic.

HHS OCR settled with UnitedHealthcare Insurance Company (UHIC) for $80,000 regarding failure to provide timely access to protected health information (PHI) per 45 C.F.R. § 164.524(a). The incident stemmed from an employee error where a request for medical records sent via mail to a Utah P.O. Box was not responded to. UHIC entered a Corrective Action Plan to revise policies, train workforce, and report on access requests.

UnitedHealthcare reported a data breach to the Oregon Attorney General. The breach was reported on 2023-06-09. The breach occurred during 2/19/2023 - 2/20/2023. The breach was discovered on 2/20/2023. 16,844 individuals were affected. Notice was sent on 6/9/2023.

UnitedHealthcare notified Montana residents of a credential stuffing attack on its mobile application occurring Feb 19-25, 2023, discovered Feb 22, 2023. Affected data included names, DOB, addresses, and PHI (member IDs, claims). UHC locked accounts, reset passwords, and offered 2 years of LifeLock identity theft protection.

UNITEDHEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-135). The register records the breach as discovered on October 14, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITEDHEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-123). The register records the breach as discovered on March 18, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITEDHEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-122). The register records the breach as discovered on June 12, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITEDHEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-124). The register records the breach as discovered on July 26, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITEDHEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-128). The register records the breach as discovered on March 10, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

UNITEDHEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-127). The register records the breach as discovered on January 1, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.