The Change Healthcare cyberattack: what stopped on February 21, 2024, what came back when, and the breach that reached 192.7 million people

What it says#

UnitedHealth Group's Form 8-K, filed February 22, 2024 under the SEC's cybersecurity item, says that "on February 21, 2024, UnitedHealth Group (the 'Company') identified a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare information technology systems," and that "immediately upon detection of this outside threat, the Company proactively isolated the impacted systems from other connecting systems." The amendment filed March 8 revised the attribution to "cybercrime threat actors" and attached the March 7 press release. The April 24 amendment attached the April 22 release on the data review. Each filing repeated that the company had "not determined the incident is reasonably likely to materially impact the Company's financial condition or results of operations."

The mechanics came out in Andrew Witty's written testimony to the Senate Finance Committee on May 1, 2024. The attacker "calling themselves ALPHV or BlackCat deployed a ransomware attack inside Change Healthcare's information technology environments, encrypting Change's systems." Before that, "on February 12, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal, an application used to enable remote access to desktops. The portal did not have multi-factor authentication. Once the threat actor gained access, they moved laterally within the systems in more sophisticated ways and exfiltrated data. Ransomware was deployed nine days later." Witty also told the committee that "the decision to pay a ransom was mine."

The restoration schedule is in UHG's own releases. On March 7 the company said electronic prescribing was "fully functional with claim submission and payment transmission also available as of today," that the payments platform would be "available for connection beginning March 15," and that it expected "to begin testing and reestablish connectivity to our claims network and software on March 18." Optum had launched a Temporary Funding Assistance Program on March 1, and UnitedHealthcare said it would advance funds weekly to "medical, dental and vision providers" for the gap between historical and post-attack payment levels, with "no fees, interest or other associated costs" and repayment due 30 days after an invoice once standard payments resumed. On March 18 the company said it had "advanced more than $2 billion thus far" and was releasing "medical claims preparation software" to customers. On April 22 it reported pharmacy at 99 percent of pre-incident pharmacies, medical claims "flowing at near normal levels," and payment processing, "which represents approximately 6% of all payments in the U.S. health care system," at about 86 percent of pre-incident levels, with "approximately 80% of Change functionality" restored. UHG's first-quarter 2024 earnings release put the cost at "$872 million in unfavorable cyberattack effects" in earnings from operations.

The data side took longer. The April 22 release said sampling had found files with PHI or PII "which could cover a substantial proportion of people in America," that 22 screenshots had been posted on the dark web "for about a week," and that the company was offering two years of free credit monitoring through a call center at 1-866-262-5342 and changecybersupport.com, while stating "this is not an official breach notification." HHS's Office for Civil Rights, in its FAQ page, records the rest: Change Healthcare "filed a breach report with OCR" on July 19, 2024 listing "500 individuals as the 'approximate number of individuals affected,'" the minimum that triggers a posting; on October 22, 2024 it reported "approximately 100 million individual notices" sent; on January 24, 2025, "approximately 130 million individual notices" sent and "approximately 190 million individuals" affected; and on July 31, 2025, "approximately 192.7 million individuals." UHG's 10-K for 2024 states: "We have determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million."

Who it applies to#

For the outage, any office that sent claims or attachments, checked eligibility or received remittances through Change Healthcare, including practices that never signed a contract with Change and only knew their practice-management vendor's clearinghouse name. ADA News on February 27, 2024 reported that the attack was "preventing some dentists from sending electronic claims and attachments to insurance companies to receive payment," and on March 6 listed vendor workarounds from Henry Schein One, Open Dental, Curve Dental and Patterson's Eaglesoft, which added Vyne Dental. The ADA's April 15, 2024 letter to the House Energy and Commerce Committee said members "reported delayed claims, additional expenses incurred due to resorting to physical mailing, and increased office staff time spent on call centers and troubleshooting," and that "in the nearly ten weeks since the cyber-attack, dental services have yet to be fully restored."

For the breach, OCR's FAQ is the rulebook. OCR "prioritized and opened investigations of Change Healthcare and UnitedHealth Group," focused on "whether a breach of protected health information (PHI) occurred and on the entities' compliance with the HIPAA Rules," and said its interest in the entities that partnered with them "is secondary." A covered entity that discovers a breach, including by notice from its business associate, must notify affected individuals "without unreasonable delay," HHS, and for breaches over 500 people the media; but "a covered entity may delegate to its business associate the tasks of providing the required" notifications, and "only one entity, which could be the covered entity itself or its business associate, needs to complete notifications." OCR said it would not start the 60-day clock for covered entities "until affected covered entities have received the information needed from Change Healthcare or UHG."

What changed#

Before February 2024 a clearinghouse outage was a nuisance measured in hours. This one was measured in weeks, and it exposed how many dental offices routed everything through a single intermediary they had never chosen. UHG's releases created two things that did not exist before: a funding program for providers whose payers used Change, and a standing offer to perform HIPAA notifications on providers' behalf. The ADA's response to Congress asked for financial impact assessments, prompt-pay legislation, stronger e-prescribing standards, HIPAA parity for health IT vendors and cybersecurity support for small practices.

For the breach count, what changed is the number. The July 2024 report listed 500 people; by July 31, 2025 the figure Change gave OCR was 192.7 million. OCR's FAQ page, last updated March 14, 2025 with that July entry added, was the most recent OCR statement found for this entry; no OCR announcement resolving its investigations of Change Healthcare or UHG was found on hhs.gov as of September 13, 2026, and the FAQ does not describe one.

Where the source is#

The 8-K and its two amendments, with the March 7 and April 22 press releases attached as exhibits, are on EDGAR under UnitedHealth Group, and the 2024 Form 10-K is there too; the SEC serves them to any client that identifies itself. Witty's written testimony is on the Senate Finance Committee's site. OCR's FAQ page is on hhs.gov and loaded with full browser headers; OCR's March 2024 press release and Dear Colleague letter have moved to HHS's archive and could not be retrieved, so the FAQ is cited for the letter and the investigations. The March 7 and March 18 UHG updates are also on unitedhealthgroup.com's newsroom. The ADA News articles and the ADA's April 15, 2024 comment letter are on ada.org. Change Healthcare's HIPAA substitute notice URL now redirects to Optum's home page; its contents are cited here as ADA News summarized them.