Change Healthcare

changehealthcare.com

CONFIRMED

Change Healthcare (UnitedHealth Group) suffered a devastating ALPHV / BlackCat ransomware extortion attack halting healthcare clearinghouse networks nationwide and impacting 100M individuals.

Observable Status CONFIRMED

Industry / Sector Healthcare

Incident Classification Ransomware Extortion & Healthcare Pipeline Disruption

Attributed Threat Actor ALPHV / BlackCat

Affected Population 100,000,000 records

First Seen 2024-02-21

Last Updated 2024-10-24

Compromised Data Classes:

Protected Health Information (PHI) Social Security Numbers (SSNs) Medical Claims & Diagnostic Data Banking & Direct Deposit Information Medical Claims Billing Information

Statutory Regulatory Filings:

U.S. Securities and Exchange Commission (SEC): Form 8-K Item 1.05 (Material Cybersecurity Incidents) (0000731766-24-000010) HHS OCR: HIPAA Breach Portal Report (HHS-OCR-2024-001)

OPEN WEIGHTS TELEMETRY • DETERMINISTIC CONFIDENCE

Confidence & Source Corroboration

100% CONFIDENCE

1. Primary Authority CONFIRMED BY REGULATOR Base weight: 65%

2. Evidence Specificity +23% Statutory Filing Verified

3. Corroboration Curve +21% 4 independent domains

4. Timeline & Staleness +3% 4 milestones logged

Corroborated Source Domains:

unitedhealthgroup.com sec.gov cisa.gov ocrportal.hhs.gov

STATUTORY REGULATORY DISCLOSURES

Official Regulatory Filings & Legal Compliance Records

2 Verified Statutory Filings

Regulatory Ground Truth Standard: The disclosures below represent formal statutory filings and enforcement records submitted to government regulatory authorities (SEC, State Attorneys General, HHS OCR, CISA). In accordance with repository principles, this data is captured exactly as filed by the reporting entity and is never modified, overridden, or synthesized by AI models.

U.S. Securities and Exchange Commission (SEC)

Form 8-K Item 1.05 (Material Cybersecurity Incidents)

CONFIRMED BY REGULATOR

Docket / Accession ID 0000731766-24-000010

Statutory Filing Date 2024-02-21

Disclosed Impact 100,000,000 records

Evidence Standard Regulatory Ground Truth

Statutory Filing Details & Summary (Preserved As Filed):

Item 1.05 Material Cybersecurity Incident disclosure filed by UnitedHealth Group reporting suspected cybercrime intrusion into Change Healthcare IT environments resulting in nationwide healthcare billing and pharmacy disruptions.

View Official Regulatory Filing Document https://www.sec.gov/Archives/edgar/data/731766/000073176624000010/uhg-20240221.htm

HHS OCR

HIPAA Breach Portal Report

CONFIRMED BY REGULATOR

Docket / Accession ID HHS-OCR-2024-001

Statutory Filing Date 2024-02-21

Disclosed Impact 100,000,000 records

Evidence Standard Regulatory Ground Truth

Statutory Filing Details & Summary (Preserved As Filed):

Official statutory regulatory filing submitted by Change Healthcare to HHS OCR pursuant to applicable data breach disclosure mandates.

View Official Regulatory Filing Document https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

Technical Forensic Briefing

Incident Overview

Change Healthcare (UnitedHealth Group) suffered a devastating ALPHV / BlackCat ransomware extortion attack halting healthcare clearinghouse networks nationwide and impacting 100M individuals.

Compromised Assets & Data Scope

Primary Data Classes: Protected Health Information (PHI), Social Security Numbers (SSNs), Medical Claims & Diagnostic Data, Banking & Direct Deposit Information.
Disclosed Affected Population: Approximately 100,000,000 individuals or records.

Statutory Disclosures & Compliance

Statutory filing submitted to SEC (Form 8-K (Item 1.05)) under accession 0000731766-24-000010.
Statutory filing submitted to HHS OCR (HIPAA Breach Portal Report) under accession HHS-OCR-2024-001.

Milestone Timeline (4 events logged)

2024-02-21 14:00 UTC

CONFIRMED BY TARGET

Change Healthcare confirms widespread network disruption to prescription routing, claims processing, and clinical operations.

Source: UnitedHealth Group Official Disruption Bulletin

2024-02-22 17:30 UTC

CONFIRMED BY REGULATOR

UnitedHealth Group files SEC Form 8-K Item 1.05 disclosing suspected cybercrime intrusion into Change Healthcare IT environments.

Source: SEC EDGAR 8-K Item 1.05 (Adsh 0000731766-24-000010)

2024-02-28 19:00 UTC

INDEPENDENT VERIFICATION

ALPHV / BlackCat ransomware extortion gang claims responsibility, stating 6 TB of sensitive patient and financial records were exfiltrated.

Source: CISA & FBI Joint Cybersecurity Advisory (AA24-060A)

2024-10-24 18:00 UTC

CONFIRMED BY REGULATOR

HHS OCR breach portal registers confirmed affected population of approximately 100,000,000 individuals.

Source: HHS OCR Data Breach Portal Entry (Change Healthcare)

Have updated information or a new verifiable source?

This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.

Propose Update via GitHub