Change Healthcare hit by cyberattack

UnitedHealth Group-owned Change Healthcare confirmed it has fallen victim to a cyberattack that was first announced at 2:15 EST on February 21.  

“Change Healthcare is experiencing a cyber security issue, and our experts are working to address the matter. Once we became aware of the outside threat, in the interest of protecting our partners and patients, we took immediate action to disconnect our systems to prevent further impact,” the company wrote in a brief statement on its status page on February 22 at 15:42 EST.   

“At this time, we believe the issue is specific to Change Healthcare and all other systems across UnitedHealth Group are operational. The disruption is expected to last at least through the day. We will provide updates as more information becomes available.” 

The specific details of the attack are unknown at this time, but the widespread system disruption is raising concerns about the potential scope of damage and data exposure. 

Change Healthcare is a revenue cycle management service provider that processes 15 billion transactions annually for healthcare providers and payers nationwide, according to a report in the HIPAA Journal.  

The company shares on its website that one in three patient records in the U.S. are “touched by our clinical connectivity solutions.”  

In 2022, UnitedHealth Group finalized its merger of Optum and Change Healthcare in a $7.8 billion agreement. This strategic move granted Optum extensive access to patient records spanning tens of millions of Americans. It’s unclear if the attackers have also gained access to Optum’s data.