ENKR

Change Healthcare ransomware attack and data theft

Add to my breach check

Made public · 192,700,000 people

What leaked12

Hard to replace

  • Driver's licence number
  • Health insurance or Medicare number
  • Passport number
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • Social Security number
  • Date of birth
  • Full name
  • Health informationmedical record numbers, providers, diagnoses, medicines, test results, images, care and treatment; varies by person
  • Driver's licence numberdriver's licence or state ID number
  • Health insurance or Medicare numberhealth insurance details: plans, insurers, member and group ID numbers, Medicaid and Medicare ID numbers
  • Bank account numberaccount numbers, financial and banking information
  • Mobile numberphone number · type not stated
  • Full namecontact information; not the same for every person
  • Other profile databilling and payment information including payment cards · card details not stated

To-dos13 · about 3 h 30 min in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name · Limits harm from: applications with your ID (opens in a new tab)
  2. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name, applications with your ID (opens in a new tab)
  3. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name, applications with your ID (opens in a new tab)
  4. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  5. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
8 more
  1. This weekTurn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
  2. When convenientKnow the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages, scam calls
  3. When convenientTurn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  4. When convenientTurn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  5. When convenientFreeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  6. When convenientCheck your health insurance statements for care you did not getabout 15 minHelps you notice: medical care in your name (opens in a new tab)
  7. When convenientRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  8. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next19 events

  1. Undetected 2 events9 days · show events
  2. Response 11 eventsNotice in 120 days · show events
  3. Remedy 1 eventOngoing · show events
  4. Penalty 3 eventsUnder investigation · show events
  5. Disputes 2 eventsOngoing · show events
  1. Updated count to HHS: about 192.7 million people
  2. About 130 million notices sent; about 190 million people affected
  3. Nebraska's attorney general sued Change Healthcare, UnitedHealth Group and Optum in Lancaster County District Court
  4. About 100 million individual notices sent
  5. Filed a breach report with HHS OCR · placeholder count of 500
14 more
  1. HIPAA media notice; notice to affected customers began, mailings to individuals expected from late July
  2. Federal cases centralised as MDL No. 3108 in the District of Minnesota
  3. CEO testified that he decided to pay the ransom; he confirmed 22 million USD to senators
  4. CEO's written testimony to Congress: attackers used stolen credentials on a Citrix remote-access portal without multi-factor authentication on February 12, 2024
  5. Offered a dedicated call centre and two years of free credit monitoring and identity theft protection to anyone affected
  6. Said the files could cover a substantial proportion of people in America
  7. 22 screenshots allegedly from the stolen files, some with health and personal data, were posted on the dark web for about a week
  8. HHS OCR opened investigations of Change Healthcare and UnitedHealth Group under HIPAA
  9. Confirmed that a substantial quantity of data was exfiltrated between February 17, 2024 and February 20, 2024
  10. A wallet linked to ALPHV received 350 bitcoin · about 22 million USD, reported as a possible ransom payment
  11. Form 8-K Item 1.05 · material cybersecurity incident
  12. Isolated the affected Change Healthcare systems from connected systems
  13. Ransomware found on Change Healthcare systems; systems disconnected and law enforcement contacted
  14. Intrusion began
Company
Change Healthcare
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
192,700,000 people · approx.; Change Healthcare's report to HHS, July 31, 2025

How the facts developed

  1. Count reported to HHS rose to about 192.7 million people (about 190 million in January 2025)
  2. HIPAA media notice: contact details plus, depending on the person, health insurance, health, billing and payment data, Social Security, driver's licence or passport numbers

Sources