UnitedHealth paid ransom to bad actors, says patient data was compromised in Change Healthcare cyberattack

UnitedHealth paid ransom to bad actors, says patient data was compromised in Change Healthcare cyberattack


Omar Marques | Lightrocket | Getty Images

UnitedHealth Group on Monday said it paid a ransom to cyber threat actors to try and protect patient data, following the February cyberattack on its subsidiary Change Healthcare. The company also confirmed that files containing personal information were compromised in the breach.

“This attack was conducted by malicious threat actors, and we continue to work with the law enforcement and multiple leading cyber security firms during our investigation,” UnitedHealth told CNBC in a statement. “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.”

The company did not specify the ransom payment amount.

UnitedHealth, which has more than 152 million customers, said it has also determined that the cyber threat actors accessed files containing protected health information and personally identifiable information, according to a release Monday. The files “could cover a substantial proportion of people in America,” the release said.

Change Healthcare offers payment and revenue cycle management tools. The company facilitates more than 15 billion transactions annually, and one in every three patient records passes through its systems. This means even patients who are not UnitedHealth customers could have been impacted by the attack.

UnitedHealth said in the release that 22 screenshots, allegedly of the compromised files, have been uploaded to the dark web. The company said no other data has been published, and it has not seen evidence that doctors’ charts or full medical histories were accessed in the breach.

“We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it,” UnitedHealth CEO Andrew Witty said in the release.

UnitedHealth said that concerned patients can visit a dedicated website for access to resources. The company has launched a call center that will offer free identity theft protections and credit monitoring for two years, the release said.

The call center will not be able to offer any details about individual data impact given the “ongoing nature and complexity of the data review,” UnitedHealth said.



Source

Healthy Returns: AstraZeneca CEO proposes some U.S. drug price cuts amid Trump pressure
Health

Healthy Returns: AstraZeneca CEO proposes some U.S. drug price cuts amid Trump pressure

The office building of international biopharmaceutical company AstraZeneca. Cfoto | Future Publishing | Getty Images A version of this article first appeared in CNBC’s Healthy Returns newsletter, which brings the latest health-care news straight to your inbox. Subscribe here to receive future editions. President Donald Trump has been pressuring pharmaceutical companies to lower U.S. drug […]

Read More
Trump’s pharmaceutical tariffs could affect some drugmakers more than others
Health

Trump’s pharmaceutical tariffs could affect some drugmakers more than others

Medications are stored on shelves at a pharmacy on May 12, 2025 in Los Angeles, California. Eric Thayer | Getty Images President Donald Trump is slated to impose tariffs on pharmaceuticals imported into the U.S. any day now – and the duties may have a bigger impact on some drugmakers than others, according to some […]

Read More
Merck plans  billion cost cuts by end of 2027, narrows full-year outlook
Health

Merck plans $3 billion cost cuts by end of 2027, narrows full-year outlook

Merck & Co. signage on the floor of the New York Stock Exchange (NYSE) in New York, US, on Tuesday, April 8, 2025. Michael Nagle | Bloomberg | Getty Images Merck on Tuesday said it will slash $3 billion in costs by the end of 2027 to be fully reinvested to support new product launches […]

Read More