ENKR

Change Healthcare ransomware attack and data theft

Add to my breach check

Made public · 192,700,000 people

What leaked12

Hard to replace

  • Driver's licence number
  • Health insurance or Medicare number
  • Passport number
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • Social Security number
  • Date of birth
  • Full name
  • Health informationmedical record numbers, providers, diagnoses, medicines, test results, images, care and treatment; varies by person
  • Driver's licence numberdriver's licence or state ID number
  • Health insurance or Medicare numberhealth insurance details: plans, insurers, member and group ID numbers, Medicaid and Medicare ID numbers
  • Bank account numberaccount numbers, financial and banking information
  • Mobile numberphone number · type not stated
  • Full namecontact information; not the same for every person
  • Other profile databilling and payment information including payment cards · card details not stated

To-dos13 · about 3 h 30 min in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name · Limits harm from: applications with your ID (opens in a new tab)
  2. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name, applications with your ID (opens in a new tab)
  3. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name, applications with your ID (opens in a new tab)
  4. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  5. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
8 more
  1. This weekTurn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
  2. When convenientKnow the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages, scam calls
  3. When convenientTurn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  4. When convenientTurn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  5. When convenientFreeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  6. When convenientCheck your health insurance statements for care you did not getabout 15 minHelps you notice: medical care in your name (opens in a new tab)
  7. When convenientRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  8. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next19 events

  1. Undetected 2 events9 days · show events
  2. Response 11 eventsNotice in 120 days · show events
  3. Remedy 1 eventOngoing · Back to latest
  4. Penalty 3 eventsUnder investigation · show events
  5. Disputes 2 eventsOngoing · show events

Remedy: 1 event

Back to latest
  1. Offered a dedicated call centre and two years of free credit monitoring and identity theft protection to anyone affected
Company
Change Healthcare
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
192,700,000 people · approx.; Change Healthcare's report to HHS, July 31, 2025

How the facts developed

  1. Count reported to HHS rose to about 192.7 million people (about 190 million in January 2025)
  2. HIPAA media notice: contact details plus, depending on the person, health insurance, health, billing and payment data, Social Security, driver's licence or passport numbers

Sources