UnitedHealth Data Breach Overview

(Reuters) – The February hack at UnitedHealth (NYSE:UNH)'s tech unit Change affected the personal information of 100 million people, as reported on the U.S. health department's website, marking it as the largest healthcare data breach in the country.

Background
UnitedHealth previously stated that hackers may have stolen a third of Americans' data in one of the most severe hacks to impact the U.S. healthcare sector. The company began notifying affected patients in June.

The numbers affected were listed in the U.S. Department of Health & Human Services' office for civil rights' database of data breaches. In comparison, a breach at Anthem (now Elevance Health) in 2015 impacted nearly 79 million people in the U.S.

Ongoing Investigation
UnitedHealth confirmed that the investigation is in its final stages, and the company continues to notify potentially impacted individuals promptly.

The breach was executed by a hacking group known as ALPHV, or "BlackCat." UnitedHealth first reported the breach on February 21.

Impact of the Breach
The incident caused significant disruptions in claims processing, affecting patients and healthcare providers nationwide. In June, UnitedHealth issued a public notice regarding the ransomware hack as part of their notification requirements for the estimated one-third of the population whose private data may have been compromised.

While the company stated it cannot confirm the specific nature of the affected data, possibilities include health insurance member IDs, patient diagnoses, treatment information, social security numbers, and billing codes used by providers.

Financial Consequences
Earlier this month, expectations indicated a $705 million business disruption impact from the hack due to massive payment issues and other disruptions across the U.S. UnitedHealth has issued billions in loans to providers affected by the breach and incurred costs related to notifying customers about the incident.