What happened
Largest healthcare data breach in US history. BlackCat (ALPHV) ransomware operators used stolen credentials to access Change Healthcare's Citrix remote-access service, which did not have MFA enabled. 190 million Americans had personal and healthcare data stolen. UnitedHealth paid a $22 million ransom. Total financial impact reported at $2.45 billion through Q3 2024 per UNH earnings filings.
Reported impact: $22M ransom, $2.45B+ total cost
Source: BleepingComputer / UNH 10-Q filings, 21 Feb 2024.
What to do if you were affected
- Change the password for this account, and for any other account that used the same one.
- Turn on two-step sign-in for your email.
- Watch statements and messages that ask you to confirm details; they often follow a breach.
Common questions
When was the Change Healthcare (UnitedHealth): BlackCat ransomware breach disclosed?
In February 2024. Public reporting was carried by BleepingComputer / UNH 10-Q filings.
How many people were affected?
190,000,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with Change Healthcare (UnitedHealth): BlackCat ransomware at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it, and not reusing it, closes that door.
Other breaches in this sector
Is your address in a public breach? Check my address →