Change Healthcare Breach Hits 100M Americans – Krebs on Security

The scope of this breach is incredible.

In April, Change estimated the breach would affect a "substantial proportion of people in America." On Oct 22, the healthcare giant notified the U.S. Department of Health and Human Resources (HHS) that "approximately 100 million notices have been sent regarding this breach."

A notification letter from Change Healthcare said the breach involved the theft of:

• Health Data: Medical record #s, doctors, diagnoses, medicines, test results, images, care and treatment;
• Billing Records: Records including payment cards, financial and banking records;
• Personal Data: Social Security number; driver's license or state ID number;
• Insurance Data: Health plans/policies, insurance companies, member/group ID numbers, and Medicaid-Medicare-government payor ID numbers.

The HIPAA Journal reports that in the nine months ending on September 30, 2024, Change's parent firm United Health Group had incurred $1.521 billion in direct breach response costs, and $2.457 billion in total cyberattack impacts.

Once this data is out there it is just out there. The only thing we can do is attempt to minimize the ability for criminals to leverage such incredibly comprehensive data.