The company had announced an initial estimate of 190 million in January, according to a Thursday (Aug. 14) Reuters report.
“The final total number of individuals impacted by the Change Healthcare cyberattack is approximately 192.7 million,” a UnitedHealth spokesperson said, adding that the individual state numbers will vary in each state.
The latest figures were posted on a list of data breaches maintained by the U.S. health department’s office for civil rights, Reuters reported.
The data breach at UnitedHealth’s tech unit, Change Healthcare, was the largest such occurrence in the U.S. healthcare industry to date. The incident was disclosed last February. Change Healthcare was infiltrated by the “Blackcat” ransomware group, which caused widespread disruptions nationwide in claims processing and impacted patients and providers.
“Information made vulnerable in the UnitedHealth attack is believed to include health insurance member IDs, patient diagnoses, treatment information and social security numbers, as well as billing codes used by providers,” Reuters reported.
Advertisement: Scroll to Continue
Change Healthcare had to process $14 billion in backlogged healthcare claims following the incident, PYMNTS reported in March 2024, after it spent a month working to restore services when the healthcare payment system was disrupted.
The hackers infiltrated through the Citrix portal, UnitedHealth Group CEO Andrew Witty testified last May.
“On February 12, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal, an application used to enable remote access to desktops,” Witty said in testimony posted on the website of the House Energy & Commerce Committee.
“The portal did not have multi-factor authentication,” Witty added. “Once the threat actor gained access, they moved laterally within the systems in more sophisticated ways and exfiltrated data. Ransomware was deployed nine days later.”
PYMNTS noted at the time that the cyberattack was one of the costliest ever and could have slashed UnitedHealth Group’s profit by $1.6 billion in 2024.
