100 million people impacted by February ransomware attack, reveals Change Healthcare

Eight months after the infamous cyberattack, Change Healthcare has revised its filings with the US federal government to report that approximately 100 million individuals had their information compromised by hackers during a ransomware attack in February this year.

According to reports, the Office for Civil Rights at the Department of Health and Human Services (HHS) reported that Change Healthcare informed them on October 22 that "approximately 100 million notifications have been sent to individuals concerning this breach."

Nashville (Tennessee)-headquartered Change Healthcare, in June, acknowledged that the hackers involved in the incident likely gained access to health insurance details, comprehensive personal health information such as test results and medical images, financial and banking data, as well as personal information like Social Security numbers.

The company has additionally amended its filing in the HHS breach notification portal to reflect the updated total of 100 million.

The recent notice came after HHS granted Change Healthcare permission in May to submit breach notifications on behalf of the thousands of organizations affected by the ransomware attack, which severely disrupted the U.S. healthcare system for months due to the company's critical role in processing payments and prescriptions.

Change Healthcare's CEO previously stated to Congress that about one-third of all Americans have had their information processed by the company, which oversees roughly one in three medical records and handles nearly half of all medical claims in the United States.

Reports say the ransomware attack, carried out by a now-defunct group taken down by law enforcement, has become one of the largest breaches in U.S. history. UnitedHealth, the parent company of Change Healthcare, stated that the attack led to $872 million in losses, with direct costs estimated between $1 billion and $1.15 billion during earnings call in April.

The company, as per reports, paid a ransom of $22 million to the hackers involved. A dispute among the hackers resulted in the sensitive data being posted on another leak site.

This incident underscores the national security concerns surrounding ransomware, as it resulted in the leak of extensive sensitive healthcare information on the dark web, inflicting significant damage on hospitals, doctors, and pharmacies that are still managing claims backlogs.