Until now, the worst healthcare data breach occurred in 2015, exposing 78.8 million people to risk. But the stakes have been raised.
The significant cyberattack hit a new record of affecting 100 million people – and it happened to strike the largest healthcare company in the world (by revenue), UnitedHealth Group.
The actual incident occurred in February 2024, when a ransomware attack disrupted pharmacies nationwide, as originally reported by Reuters. The target was Change Healthcare, a subsidiary of UnitedHealth Group that handles financial affairs for healthcare providers. Cybercriminals found their way into the system of Change Healthcare due to the lack of multi-factor authentication in login credentials.
A statement issued by the Senate Finance Committee described the nightmarish outcomes of the breach, which included prescriptions not being filled, doctors and hospitals not receiving their payments, and insurance companies unable to reimburse healthcare providers. Senator Ron Wyden, a Democrat from Oregon, said in the committee’s statement: “Many consider the Change Healthcare breach to be the biggest healthcare cybersecurity disruption in American history.”
Nearly a third of all U.S. citizens are connected in one way or another to the organization, which includes a lot of personal data. We all knew it was bad at the time, as Change Healthcare’s CEO stated that the stolen files contained the personal health data of “a significant portion of people in America,” according to TechCrunch.
The attack is alleged to have been carried out by the BlackCat Ransomware gang, which was confirmed by Change Healthcare. A post on the dark web later claimed by a group based in Russia that they had stolen healthcare and patient information for millions of Americans.
But now, the U.S. Department of Health and Human Services has updated the number of affected individuals in its data breach portal to reveal the extent of the issue: a terrifying 100 million people. Even an industry journal suggested that the approximate number of 100 million could change in the future, as reported by the Daily Mail. We hope this means that the actual number might be smaller, but it could easily go in the opposite direction.
The massive scale makes the 5.3 million data breaches affecting Mexico’s healthcare systems reported just yesterday seem insignificant in comparison.
