United HealthCare Services, Inc.

ent_019e61c3660932a5131051156ef0e1ec

Compliance scorecard →View in feed →

Disclosures

25+

HHS OCR · State AG · 6 jurisdictions

Multi-filing incidents

incidents joining 2+ filings here

Max affected reported

398,319

nationwide · HHS OCR CT

Leak-site claims

none in sample

Identity resolution

Canonical name: United HealthCare Services, Inc.
Normalized: united healthcare— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: 254900ZHD9TT9YJNZ950
SEC EDGAR CIK: None — not an SEC registrant
Domain: uhc.com
Corporate parent: UNITEDHEALTH GROUP INCORPORATED— per GLEIF relationship records

Disclosure history (newest 25)newest first

CONNECTICUTHHS OCRas reporting2026-06-19
UnitedHealth Care Services, Inc. Single Affiliated Covered Entity reported to HHS on 2026-06-19 a Hacking/IT Incident affecting 37384 individuals. Breached information located on Email. Business associate was present.
CONNECTICUTHHS OCRas reporting2026-06-05
UnitedHealth Care Services, Inc. Single Affiliated Covered Entity reported to HHS on 2026-06-05 a Hacking/IT Incident affecting 34574 individuals. Breached information located on Network Server.
Washington State AGas victim2025-06-27
MedicareCompareUSA notified the Washington AG of a phishing incident affecting United Healthcare policyholders. Unauthorized access to email accounts occurred Nov 5-21, 2024. Data exposed: names, SSNs, Medicare numbers, DOBs. 1,258 WA residents notified on June 27, 2025. Credit monitoring offered.
Massachusetts State AGas reporting2025-06-27
MedicareCompareUSA filing on behalf of United Healthcare reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-06-27. 1 Massachusetts residents were affected.
Indiana State AGas reporting2025-06-27
MedicareCompareUSA filing on behalf of United Healthcare reported a data breach to the Indiana Attorney General. The breach occurred on 2024-11-05 and was reported on 2025-06-27. 1 Indiana residents were affected. 2,537 individuals affected in total.
Nebraska State AGas victim2025-06-27
MedicareCompareUSA reported a phishing incident affecting United Healthcare data. Unauthorized access occurred Nov 5-21, 2024, exposing names, SSNs, and health policy numbers. One Nebraska resident was notified on June 27, 2025. MCUSA provided credit monitoring and notified HHS.
Illinois State AGas victim2024-06-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in June 2024 (case 24-06-019). The register records the breach as discovered on April 22, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2024-03-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in March 2024 (case 24-03-004). The register records the breach as discovered on December 1, 2022. Additional entities named: OPTUM, ALL ABOARD AMERICA! HOLDINGS, INC, THE U OF AR. SYSTEM, BIOMIEUX, INC., FIDELITY MGMT. & RESEARCH, LLC, GOV'T EMPLOYEES HEALTH ASSOC, NOKIA OF AMERICA CORP., TEMPO, INC., STATE OF TN., TRH HEALTH PLANS, BAPTIST HOSPITALS OF SE TX, CENTRAL AR RADIATION THERAPY INSTITUTE, INC., EMERUS HOLDINGS, INC., GREATER ST. LOUIS CONSTRUCTION LABORERS' WELFARE FUND, LITTLE ROCK WATER RECLAMATION AUTHORITY, NORTHERN LIGHT HEALTH, NAT'L RURAL ELECTRIC COOP. ASSOC., THE ODP CORP., SCHWARZ PARTNERS, LP, SIGNODE INDUSTRIAL GROUP, LLC, UNITED HEALTH GROUP, INC.. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2024-02-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in February 2024 (case 24-02-207). The register records the breach as discovered on February 15, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2024-02-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in February 2024 (case 24-02-192). The register records the breach as discovered on November 22, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2024-02-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in February 2024 (case 24-02-190). The register records the breach as discovered on May 5, 2023. Additional entities named: CHOICE MEDICAL GROUP. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2024-02-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in February 2024 (case 24-02-191). The register records the breach as discovered on October 12, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2024-02-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General in February 2024 (case 24-02-206). The register records the breach as discovered on January 1, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Washington State AGas victim2023-12-22
United Healthcare Services, Inc. (Welltok) reported a supplemental data event to Washington AG. An unknown actor exploited a zero-day vulnerability in MOVEit Transfer software to access the server on May 30-31, 2023, and exfiltrated data. Welltok detected the compromise on July 26, 2023. Data included names, addresses, DOBs, and Medicaid IDs. 9,938 Washington residents were notified on Dec 22, 2023. Credit monitoring offered.
CONNECTICUTHHS OCRas victim2023-12-08
United Healthcare Services, Inc. reported to HHS on 2023-12-08 a Hacking/IT Incident affecting 4,264 individuals. The CE impermissibly disclosed PHI to a business associate, whose employee was then subjected to an email phishing scheme that compromised the PHI. Data exposed included names, addresses, birthdates, SSNs, and health insurance/treatment information. Breached information located on Email.
CONNECTICUTHHS OCRas victim2023-09-07
United Healthcare Services, Inc. Single Affiliated Covered Entity reported to HHS on 2023-09-07 a Unauthorized Access/Disclosure affecting 315,915 individuals. Breached information located on Network Server. The incident involved a hacking attack exposing names and health insurance information. The entity implemented additional physical, technical, and security safeguards.
CONNECTICUTHHS OCRas victim2023-08-17
United Healthcare Services, Inc. Single Affiliated Covered Entity reported to HHS on 2023-08-17 a Hacking/IT Incident affecting 527 individuals. Breached information located on Network Server. A business associate experienced the incident, exposing PHI including names, diagnoses, claims, and financial information. The CE and BA implemented additional administrative, technical, and security safeguards.
CONNECTICUTHHS OCRas victim2023-07-28
United Healthcare Services, Inc. reported to HHS on 2023-07-28 a Hacking/IT Incident affecting 398,319 individuals. Breached information located on Network Server. A software application used by a business associate exposed PHI including names, DOB, SSNs, and medical data.
CONNECTICUTHHS OCRas victim2023-05-12
United Healthcare Services, Inc. Single Affiliated Covered Entity reported to HHS on 2023-05-12 a Unauthorized Access/Disclosure affecting 1116 individuals. Breached information located on Email. A third-party independent insurance agency fraudulently signed up individuals to its Medicare health plan using valid credentials. PHI involved included names and health insurance information.
CONNECTICUTHHS OCRas victim2023-05-05
United Healthcare Services, Inc. Single Affiliated Covered Entity reported to HHS on 2023-05-05 a Unauthorized Access/Disclosure affecting 1,971 individuals. Breached information located on Network Server. PHI including names, birthdates, claims, and financial information was viewable via the member portal.
CONNECTICUTHHS OCRas victim2023-05-05
United Healthcare Services, Inc. Single Affiliated Covered Entity reported to HHS on 2023-05-05 a Hacking/IT Incident affecting 26,561 individuals. Breached information located on Network Server. The incident involved malware affecting PHI including names, birthdates, addresses, and claims information.
Illinois State AGas victim2023-01-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-621). The register records the breach as discovered on December 1, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2023-01-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-303). The register records the breach as discovered on February 1, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2023-01-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-024). The register records the breach as discovered on June 2, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.
Illinois State AGas victim2023-01-01
UNITED HEALTHCARE filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-833). The register records the breach as discovered on April 11, 2023. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.