Change Healthcare Data Breach: 192.7 Million People, No Settlement Yet
Questions about this case?
Free · answers in seconds · general information, not legal advice
Change Healthcare is a UnitedHealth Group company that moves insurance claims and payments between doctors, pharmacies and insurers, so your records probably passed through it even if you have never heard of it. A ransomware attack in February 2024 became the largest health data breach ever reported in the U.S. The federal Change Healthcare lawsuit is a single case in Minnesota, MDL No. 3108. As of September 30, 2026, there is no Change Healthcare settlement, no fund and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened and What the Lawsuits Say
According to HIPAA Journal, attackers got into Change Healthcare systems between February 17 and 20, 2024 through a remote-access service that lacked multi-factor authentication, and the ransomware attack was discovered on February 21, 2024. The BlackCat/ALPHV ransomware group claimed responsibility. Pharmacies, hospitals and doctors' offices lost the ability to check coverage and submit claims. The stolen data included names, contact details, dates of birth, Social Security numbers and medical and insurance information, per the same report. The plaintiffs in the Change Healthcare class action allege negligence and consumer-protection violations: that the company failed to secure its network and did not notify people fast enough. Individual notification letters began going out on July 29, 2024, according to the company.
Case Details
On June 7, 2024 the Judicial Panel on Multidistrict Litigation centralized the federal cases as In re: Change Healthcare, Inc., Customer Data Security Breach Litigation, MDL No. 3108 (24-md-3108) in the U.S. District Court for the District of Minnesota, before Judge Donovan W. Frank, with Magistrate Judge Dulce J. Foster handling settlement talks. The case runs on two tracks: patients (individual plaintiffs) and healthcare providers. AboutLawsuits counted 78 lawsuits as of August 1, 2025. On December 19, 2025, Judge Frank granted in part and denied in part the motions to dismiss both tracks. Separately, Nebraska's Attorney General sued Change Healthcare, Optum and UnitedHealth Group in state court in December 2024; a Lancaster County judge denied their motion to dismiss on November 17, 2025.
Status: Pretrial, Settlement Talks Not Public
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
Change Healthcare reported 192.7 million affected individuals, which HIPAA Journal reports was submitted to the HHS Office for Civil Rights in July 2025. That is the count reported to regulators. The number was revised several times: the first filing listed a placeholder of 500, and the latest filing lists 192.7 million.
You do not have to sign up for the class action. If a class is certified or a settlement is reached, a court-appointed administrator would contact class members directly. The practical test is your mail. A notice letter should say which of your details were involved. Keep it. If you never got one but had care or filled prescriptions in the U.S. before the February 2024 attack, that alone does not tell you either way: Change Healthcare said it might not have addresses for everyone affected.
What Money Is Actually on the Table
Change Healthcare Breach Timeline
- 1
February 17–21, 2024 — Attack and Discovery
Attackers are in Change Healthcare's network February 17–20 and the ransomware attack is discovered February 21, according to HIPAA Journal. Claims processing across the country is disrupted.
- 2
June 7, 2024 — Cases Centralized
The JPML centralizes the federal lawsuits as MDL No. 3108 in the District of Minnesota. Judge Donovan W. Frank is assigned.
- 3
July 29, 2024 — Notification Letters Begin
Change Healthcare starts mailing individual notices on a rolling basis, more than five months after discovery. It said it might not have addresses for everyone.
- 4
December 16, 2024 — Nebraska Sues
Nebraska's Attorney General sues Change Healthcare, Optum and UnitedHealth Group in state court. A judge denies their motion to dismiss on November 17, 2025.
- 5
July–August 2025 — The Count Reaches 192.7 Million
Change Healthcare's reported total, per HIPAA Journal, rises to 192.7 million individuals. The credit-monitoring sign-up window and the helpline close on August 26, 2025.
- 6
December 19, 2025 to Now — Claims Narrowed, Case Continues
Judge Frank rules on the motions to dismiss: for the Minnesota patient plaintiffs, negligence, consumer-protection and health-records claims move forward, while contract and unjust-enrichment claims do not. As of September 30, 2026, no settlement has been announced.
Three Things to Watch For
A breach this large produces a steady stream of fake “claim” offers. Right now, none of them can be real:
“Claim your Change Healthcare settlement” emails and sites
There is no claim form, so there is no legitimate site asking for your Social Security number, bank details or a small “processing fee.” A real notice would come from a court-appointed administrator and name the court and case.
Calls or texts from a “UnitedHealth” or “Optum” representative
Because the stolen data included insurance details and medical information, a caller can sound informed about your plan. Hang up and call the number on your insurance card. The company's breach helpline closed August 26, 2025.
“Join the lawsuit” ads that ask for money
You do not enroll in a class action to be included, and no legitimate firm charges an upfront fee to represent you in a data breach case. Read any retainer carefully; signing one is a real legal choice, not a registration.
Change Healthcare Breach — Questions People Actually Ask
Was my data part of the Change Healthcare data breach?
Possibly. Change Healthcare processes claims for a large share of U.S. providers, and it reported 192.7 million affected individuals. The reliable answer is a notice letter, which lists what was involved for you. Your provider or insurer can also tell you whether they used Change Healthcare.
Is there a Change Healthcare settlement or claim form?
No. As of September 30, 2026, no Change Healthcare settlement has been announced, no class has been certified and no claim form exists. If that changes, class members would be notified by a court-appointed administrator.
What is the Change Healthcare lawsuit, in plain terms?
It is one federal case, MDL No. 3108 in the District of Minnesota, that combines dozens of suits over the February 2024 attack. It has a patient track and a provider track. Consolidation is procedural; it is not a class certification and not a payout.
What is the Change Healthcare class action asking for?
Patients allege negligence and consumer-protection violations over how the company secured its systems and how quickly it notified people. On December 19, 2025, ruling on the claims of three Minnesota plaintiffs, the judge let negligence, negligence per se, Minnesota consumer-protection and Minnesota Health Records Act claims go forward and dismissed contract, unjust-enrichment and declaratory-judgment claims. The ruling on plaintiffs from other states was held back for more briefing.
Did the June 2026 settlement conference produce a deal?
Not that the public record shows. A June 18, 2026 informal conference with lead counsel before Magistrate Judge Foster was set to facilitate settlement discussions. As of September 30, 2026, no settlement has been announced.
What data was exposed?
Per HIPAA Journal: names, contact information, dates of birth, Social Security numbers and medical information, plus insurance and billing details and, for some people, driver's license numbers. Your notice states which applied to you.
Can I still get the free credit monitoring?
The enrollment deadline was August 26, 2025, so new sign-ups are closed. Coverage was for two years, and sign-ups were open from 2024, so if you enrolled in 2024 your coverage may already have ended. Check your IDX enrollment confirmation for exact dates.
What should I do right now?
Freeze your credit at all three bureaus (free and reversible), read your insurer's explanation-of-benefits statements for care you did not receive, and keep your notice letter. For other recent health-data cases, see TriZetto and Aesto Health.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.