A cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group, has impacted an estimated 190 million individuals, according to updated figures released by the company, attributed to the hacking group ALPHV (also known as BlackCat).
The breach which occurred nearly a year ago, has become one of the largest healthcare-related cyber incidents in history.
UnitedHealth Group stated that the majority of affected individuals have been notified, but the exact number of impacted people will be confirmed in a future report to the Department of Health and Human Services Office for Civil Rights (OCR). The company reassured that there is no evidence of misuse of personal or medical data despite the scale of the attack.
The breach occurred in February 2024 when hackers exploited a server lacking two-factor authentication, using stolen credentials to access and exfiltrate data over several days before deploying ransomware. Initially in October, Change estimated 100 million people were affected, but the number has since risen.
UnitedHealth has begun the process of notifying impacted customers and is offering free credit monitoring for those affected however Change acknowledged it might not have sufficient contact details for all individuals involved.
The financial repercussions of the breach are significant, with UnitedHealth estimating a $2.9 billion cost to address the fallout.
Philips Babatunde