The February 2024 ransomware attack on UnitedHealth Group subsidiary Change Healthcare is the largest healthcare data breach in world history, with a final reconciled tally of approximately 192.7 million individuals affected (announced August 2025), revised upward from 100 million in October 2024 and 190 million in January 2025. The intrusion was detected on February 21, 2024, after an ALPHV/BlackCat ransomware affiliate used stolen credentials to access a Citrix remote access portal that lacked multifactor authentication, then moved laterally and exfiltrated roughly 6 TB of data over about nine days before deploying file encryption. Stolen data included names, addresses, phone numbers, dates of birth, Social Security numbers, government ID numbers, health insurance information, medical records, and billing and payment information. UnitedHealth paid a $22 million ransom for a decryptor and a deletion promise, but the BlackCat operators exit-scammed the affiliate, who then re-extorted the company via RansomHub; UnitedHealth refused the second payment. The outage halted billing and prescription processing at roughly 94% of U.S. hospitals; UnitedHealth issued about $9 billion in zero-cost provider loans and estimated total breach-related costs at $3.09 billion. Nebraska's attorney general sued in December 2024, and 50 federal class actions were consolidated in the District of Minnesota for settlement talks.

Sources

• -https://www.hipaaguide.net/change-healthcare-data-breach/
• -https://www.bleepingcomputer.com/news/security/unitedhealth-now-says-190-million-impacted-by-2024-data-breach/