What was the biggest healthcare data breach? History explored as UnitedHealthcare data breach impacts 190 million Americans

In 2024, the UnitedHealthcare data breach shocked almost everyone in the US, primarily impacting the health conglomerate’s Change Healthcare (CHC) division.

The cyberattack has been termed the most significant healthcare data breach, affecting over 190 million users in the US. However, before the UnitedHealthcare data breach, the largest cyberattack impacting medical data happened in 2015 on Anthem Inc. (currently known as Elevance Health).

Trending

The Anthem medical data breach impacted nearly 78.8 million people. As a result of this breach, Anthem Inc. had to pay $16 Million to the US Department of Health and Human Services as a penalty for the violation of the Health Insurance Portability and Accountability Act (HIPAA).

The then-largest healthcare data breach reportedly included the theft of data varying from names, street addresses, and birthdays to social security numbers, email addresses, and income data. Anthem had to pay $115 million in settlements in 2017 following various class-action lawsuits.

The number of individuals impacted by the UnitedHealthcare data breach nearly doubled from 100 million in 2024

After the UnitedHealthcare data breach, also known as the Change Healthcare ransomware attack, initial estimates suggested that at least 100 million people were impacted. However, the latest numbers given by UnitedHealth Group (UHG) were almost double the original evaluations. In a statement sent to multiple outlets, UHG’s spokesperson, Tyler Mason, talked about the severity of the UnitedHealthcare data breach; he said,

“Change Healthcare has determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million. The vast majority of those people have already been provided individual or substitute notice. The final number will be confirmed and filed with the Office for Civil Rights at a later date.”

The Department of Health & Human Services (HHS) initially estimated the number of users impacted by the UnitedHealthcare data breach, mentioning the figure of “100 million” in October 2024.

For those unaware, the ransomware attack became public last year. On February 21, Change Healthcare found out about the deployment of ransomware in its system. The company took immediate measures to minimize the impact and contacted law enforcement for further action.

Subsequent investigations showed that hackers stole data from Change Healthcare’s system between February 17 and 20, 2024. As per UHG, patient and member records such as names, addresses, contact numbers, dates of birth, and emails might be among the stolen data.

Furthermore, health insurance, social security numbers, medical record numbers, billing information, and more are also expected to be the data the hackers may have stolen. However, UHG has maintained that the information stolen via the UnitedHealthcare data breach may not be the same for everyone impacted.

Apart from the UnitedHealthcare data breach, the company was also rocked by the killing of Brian Thompson in December 2024. Thompson was UnitedHealthcare’s CEO, who was fatally shot in New York City. A suspect named Luigi Mangione was later apprehended. Following the incident, UHG issued a statement, which read,

“We are deeply saddened and shocked at the passing of our dear friend and colleague Brian Thompson, the CEO of UnitedHealthcare. Brian was a highly respected colleague and friend to all who worked with him. We are working closely with the New York Police Department and ask for your patience and understanding during this difficult time. Our hearts go out to Brian’s family and all who were close to him.”

Thompson’s death stirred debate among healthcare companies in the US. Over a month after the incident, Tim Noel was announced as the new UnitedHealthcare CEO.

×

Was this article helpful?

Thank You for feedback

Comment