UnitedHealth's Data Breach Affected 100 Million Americans. Here's What the Cyberattack Exposed. It's the largest healthcare data breach to date.

By Sherin Shibu Edited by Melissa Malamut

Key Takeaways

  • UnitedHealth Group estimates that 100 million Americans were affected by a February cyberattack, as of a new filing.
  • The cyberattack exposed sensitive information, including health records and personally identifiable information like Social Security numbers.
  • Research conducted by the nonprofit Identity Theft Resource Center shows a rise in data breaches in the U.S.

In February, Change Healthcare, a tech company owned by UnitedHealth Group (UHG), underwent a massive cyberattack that involved paying a $22 million ransom to resolve.

On Thursday, UHG quantified the number of people affected by the attack for the first time, eight months after the breach happened. A new filing in the U.S. Department of Health and Human Services portal on Thursday shows that one-third of the U.S. population, or about 100 million Americans, had their data stolen during the breach.

The cyberattack exposed sensitive health records, like medical diagnoses, test results, medications, and health plans, as well as Social Security numbers and other personally identifiable information.

Related: UnitedHealth Paid Ransom to Cyberhackers After Patients' Personal Data Was Compromised

The scope of the attack makes it the largest healthcare data breach ever, surpassing an Anthem incident in 2015 that affected almost 79 million Americans.

According to a testimony given by UHG CEO Andrew Witty before the House Energy and Commerce Committee, the data breach happened when "criminals used compromised credentials" to get into a Change healthcare portal that did not have multi-factor authentication enabled. Change handles payment processing for 15 billion medical claims per year or about 40% of all claims; UHG acquired it in late 2022.

UHG CEO Andrew Witty. Photo Credit: Tom Williams/CQ-Roll Call, Inc via Getty Images

The cyberattack disrupted daily life — some medical providers, hospitals, and pharmacies were unable to fulfill patient prescriptions and process billing for patients for weeks after it happened.

The U.S. is experiencing an overall increase in data breaches. The nonprofit Identity Theft Resource Center says there has been a 72% rise in incidents from 2021 to 2023.

Related: A Cyberattack on the Largest Health Insurer in the U.S. Could Put Your Prescriptions and Personal Data at Risk

Sherin Shibu

Entrepreneur Staff

News Reporter

Sherin Shibu is a business news reporter at Entrepreneur.com. She previously worked for PCMag, Business Insider, The Messenger, and ZDNET as a reporter and copyeditor. Her areas of coverage encompass tech, business, strategy, finance, and even space. She is a Columbia University graduate.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Business Ideas

70 Small Business Ideas to Start in 2025

We put together a list of the best, most profitable small business ideas for entrepreneurs to pursue in 2025.

Leadership

Confront Underperforming Employees With Confidence By Following This Guide to Effective Accountability

Are you struggling to hold employees accountable without creating conflict? This guide will show you how to confront underperformance with confidence, ensuring clear expectations, productive conversations and a stronger, more accountable team.

Starting a Business

Passion-Driven vs. Purpose-Driven Businesses — What's the Difference, and Why Does It Matter?

Passion and purpose are both powerful forces in entrepreneurship, but they are not the same.

Business Process

Hiring Like Crazy? Ignoring These Processes Could Derail Your Business. Here's What You Need to Know.

Hyper-growth startups will struggle if they ignore people processes. Here's why — and how leaders can ensure their startup's growth is sustainable.