UnitedHealth's Data Breach Affected 100 Million Americans. Here's What the Cyberattack Exposed. It's the largest healthcare data breach to date.

By Sherin Shibu Edited by Melissa Malamut

Key Takeaways

  • UnitedHealth Group estimates that 100 million Americans were affected by a February cyberattack, as of a new filing.
  • The cyberattack exposed sensitive information, including health records and personally identifiable information like Social Security numbers.
  • Research conducted by the nonprofit Identity Theft Resource Center shows a rise in data breaches in the U.S.

In February, Change Healthcare, a tech company owned by UnitedHealth Group (UHG), underwent a massive cyberattack that involved paying a $22 million ransom to resolve.

On Thursday, UHG quantified the number of people affected by the attack for the first time, eight months after the breach happened. A new filing in the U.S. Department of Health and Human Services portal on Thursday shows that one-third of the U.S. population, or about 100 million Americans, had their data stolen during the breach.

The cyberattack exposed sensitive health records, like medical diagnoses, test results, medications, and health plans, as well as Social Security numbers and other personally identifiable information.

Related: UnitedHealth Paid Ransom to Cyberhackers After Patients' Personal Data Was Compromised

The scope of the attack makes it the largest healthcare data breach ever, surpassing an Anthem incident in 2015 that affected almost 79 million Americans.

According to a testimony given by UHG CEO Andrew Witty before the House Energy and Commerce Committee, the data breach happened when "criminals used compromised credentials" to get into a Change healthcare portal that did not have multi-factor authentication enabled. Change handles payment processing for 15 billion medical claims per year or about 40% of all claims; UHG acquired it in late 2022.

UHG CEO Andrew Witty. Photo Credit: Tom Williams/CQ-Roll Call, Inc via Getty Images

The cyberattack disrupted daily life — some medical providers, hospitals, and pharmacies were unable to fulfill patient prescriptions and process billing for patients for weeks after it happened.

The U.S. is experiencing an overall increase in data breaches. The nonprofit Identity Theft Resource Center says there has been a 72% rise in incidents from 2021 to 2023.

Related: A Cyberattack on the Largest Health Insurer in the U.S. Could Put Your Prescriptions and Personal Data at Risk

Sherin Shibu

Entrepreneur Staff

News Reporter

Sherin Shibu is a business news reporter at Entrepreneur.com. She previously worked for PCMag, Business Insider, The Messenger, and ZDNET as a reporter and copyeditor. Her areas of coverage encompass tech, business, strategy, finance, and even space. She is a Columbia University graduate.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Business News

'Applications Are Surging': Small Business Administration Reports Significant Growth in Loan Approvals

The Small Business Administration launched its Made in America Manufacturing Initiative last month.

Money & Finance

Make Money on Autopilot With These 5 Smart Passive Income Ideas

Five innovative ways to earn money even when you're sleeping.

Business Ideas

70 Small Business Ideas to Start in 2025

We put together a list of the best, most profitable small business ideas for entrepreneurs to pursue in 2025.

Growing a Business

The Currency of Community: Building Up People for Profit

Join us for a free webinar exploring a people-first approach to business with purpose, people, and profit working in sync.

Leadership

Set Boundaries in These Key Areas to Save Your Sanity — and Your Business

Discover the key areas where boundaries are essential to maintain focus, productivity and well-being in your business journey.

Business Process

5 'Boring' Processes That Make Tech Companies Wildly Successful (and Will Work For Your Small Business, Too)

Implementing these five tech practices can transform your small business.