Change Healthcare Data Breach: What Patients Should Do
Change Healthcare sits between doctors, hospitals and insurers, so many people were affected without ever hearing the company’s name.
By Siddharth ShankarUpdated October 19, 2026A ransomware attack in February 2024 on Change Healthcare, a US health payment company, became the largest health data breach reported to US regulators. The count rose from 100 million to a revised 192.7 million people. Data could include contact details, insurance information, billing and payment data, and Social Security numbers. If you are in the US, watch your insurance statements, freeze your credit and expect scam calls.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Most patients have never heard of Change Healthcare, yet it processes claims and payments for a large share of the US health system. When it was hit, the damage spread to people who had only ever seen a doctor and filled a prescription.
What happened
The attack took place in February 2024, and the ransomware group ALPHV/BlackCat was linked to it. Change Healthcare is part of UnitedHealth Group. In October 2024, CyberScoop reported that the company told the US Department of Health and Human Services that about 100 million Americans were affected, the largest health care data breach reported to US regulators at the time.
The number was later raised. CyberInsider reports a revised figure of 192.7 million individuals, submitted to HHS on July 31, 2025. By January 2025, around 130 million people had reportedly been notified.
What data could be involved
Change Healthcare said the affected data could include:
- Contact information, such as names and phone numbers
- Health insurance details, such as the insurer
- Billing and payment information
- Other personal information, including Social Security numbers
Reports also point to medical histories and insurance claims. What applies to you depends on your records, so read any notice you receive carefully.
Why you may not know you were affected
Change Healthcare is a business behind the scenes. A notice may come from your doctor, hospital or insurer rather than from the company. Notices can also be delayed, because regulators said the reporting clock for some partners did not start until enough breach details were provided to them.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
What to do now
1Read your notice
Check what data was involved and whether it offers any free services. Do not click links in unexpected messages. See how to tell if a breach notice is real.
2Check every insurance statement
Look at each Explanation of Benefits for care you did not receive. See medical identity theft: signs and what to do.
3Freeze your credit
If your Social Security number was involved, a credit freeze is free and blocks new accounts.
4Get an IRS IP PIN
It stops someone filing a tax return with your SSN. See how to get one.
5Be careful with calls
Health data makes scams more believable. Hang up on anyone who says they are from your insurer or a provider and call back on the number on your card.
Keep a record
Save any breach notice, the date you received it and any reference numbers. If a medical bill looks wrong later, you will want proof of when you were told your data was involved. Ask your doctor’s office or insurer whether they used Change Healthcare, which can help you work out why you did or did not receive a notice.
If you are in another country
The reported figures relate to people in the US. If you live elsewhere and received a notice, follow its instructions and check with your local data protection authority about your rights.
Why health data attracts scammers
Scammers who know your insurer or a provider’s name can sound very convincing. Never give your member number, date of birth or a one-time code to someone who called you first.
What it shows
This incident shows how one vendor’s failure can expose people who never dealt with it directly. For other breaches that involved Social Security numbers, see the National Public Data breach and what to do if your SSN was leaked.
Sources
- CyberScoop: Change Healthcare breach affected 100 million Americans (100 million figure, largest health breach reported, data types)
- CyberInsider: Change Healthcare revises breach impact to 192.7 million (revised figure, ALPHV/BlackCat, 130 million notified, notification timing)
Frequently asked questions
How many people were affected by the Change Healthcare breach?
Change Healthcare first told regulators about 100 million, and later revised the total to 192.7 million, according to reports.
When did the attack happen?
In February 2024. The company is part of UnitedHealth Group.
What information was exposed?
It could include contact details, health insurance information, billing and payment data, and Social Security numbers. Reports also mention medical histories and claims.
Why did I not hear about it from Change Healthcare?
The company works behind the scenes for providers and insurers. Notices may come from them instead.
What is the most important step?
If your SSN was involved, freeze your credit and watch your insurance statements for care you did not receive.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.