UnitedHealth Group says the impact from the cyberattack last year at its Change Healthcare subsidiary is much wider than previously understood, affecting roughly 190 million patients — up from previous estimates of about 100 million people.
The updated tally extends the scope beyond what was previously described by company Chief Executive Andrew Witty, who suggested during congressional testimony in May that data for 1 in 3 Americans could be affected by the hack.
With the U.S. population standing at about 341 million people, the breach is now thought to affect about 1 in 2 Americans.
Even before Friday, the incident was by far the largest breach currently showing on the federal website, which doesn’t show a 2015 breach at health insurer Anthem Inc. that affected data for about 79 million patients.
“Change Healthcare has determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million,“ UnitedHealth Group said in a statement issued Friday afternoon. ”The vast majority of those people have already been provided individual or substitute notice.”
The company added that it “is not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis.”
Eden Prairie-based UnitedHealth Group owns UnitedHealthcare, the nation’s largest health insurer, and a fast-growing division for health services called Optum, which acquired Change Healthcare for $13 billion in 2022.
Change Healthcare was involved in processing a large share of all health care claims and payments in the U.S. — roughly 15 billion health care transactions annually before the hack, affecting 1 in 3 patient records, according to federal officials.
