Editorial draft v2 · Evidence reader R2 · Evidence cutoff: February 27, 2025
Disclosures covered: February 22, March 8, and April 24, 2024 filings; the April 22 statement; first-quarter 2024 and full-year 2024 reporting. These sources cover one Change Healthcare incident, reported by parent UnitedHealth Group.
UnitedHealth's account of the February 2024 Change Healthcare cyberattack changed substantially over the following year. An initial report of unauthorized access and uncertain disruption became an account of interrupted healthcare transactions, extensive recovery spending, and an estimated 190 million affected individuals. The disclosures also changed the company's description of the actors. Each stage needs its own date: the later figures and findings were not available in the initial report. Initial filing · March amendment · 2024 annual report
The initial account and its amendment
In its February 22 filing, UnitedHealth said it had identified access to certain Change Healthcare systems on February 21 by a suspected nation-state-associated threat actor. It isolated affected systems from connecting systems, engaged security experts, worked with law enforcement, and notified customers and agencies. Certain networks and transactional services could be unavailable. The company could not then estimate the disruption's duration or extent; it believed the interruption was specific to Change Healthcare and that its other systems remained operational. It had not determined that a material financial impact was reasonably likely. Initial filing
The March 8 amendment described the intruders as cybercrime threat actors and focused on restoring pharmacy, medical-claim, and payment services. Data-impact investigation remained under way, and UnitedHealth continued to say its other systems were operational. Its financial-materiality assessment was still undetermined. The two actor descriptions are dated company accounts; they do not establish a named group or prove that the categories are mutually exclusive. March amendment
Restoration and the developing data assessment
The April 22 statement, attached to an April 24 amendment, described substantial but incomplete restoration. Ninety-nine percent of pre-incident pharmacies could process claims; medical claims were flowing at near-normal levels, including through alternative submission methods. Change Healthcare payment processing was approximately 86% of its pre-incident level. Approximately 80% of functionality on major platforms and products had been restored. Those percentages measure different services and denominators, rather than a single recovery rate. Some providers remained adversely affected and other systems were still being restored. April amendment · April 22 statement
Initial targeted data sampling had found files containing protected health information or personally identifiable information that could cover a substantial proportion of people in America. UnitedHealth had not then seen evidence of exfiltrated doctors' charts or full medical histories. It also described 22 screenshots allegedly drawn from exfiltrated files, some containing health or identifying information, that a threat actor had posted for about a week. The company expected months of analysis before it could identify and notify affected individuals; it expressly said the April statement was not an official breach notification. April 22 statement
By the annual report filed February 27, 2025, UnitedHealth estimated approximately 190 million impacted individuals and said the vast majority had received individual or substitute notice. The final number still required confirmation and filing with the Office for Civil Rights. The estimate concerns people, not a count of confirmed stolen medical records. UnitedHealth said it was unaware of misuse resulting from the incident and had not seen electronic medical-record databases in its data analysis. Those qualified findings do not negate the health-information findings or establish that misuse could never occur. 2024 annual report
Funding, response costs, and business disruption
UnitedHealth reported different financial measures as recovery progressed. The table separates provider funding from incurred response costs and Optum Insight's estimated disruption impact; the quarterly figures sit within the later annual period and must not be added to them. First-quarter report · 2024 annual report
| Measure | First-quarter / spring 2024 account | Full-year 2024 account |
|---|---|---|
| Provider funding and interest-free loans | Approximately $3.9 billion through March 31; more than $6.5 billion through April 30 | More than $9 billion of interest-free loans through December 31 |
| Direct response costs incurred | $593 million for the three months ended March 31 | $2.2 billion for the year ended December 31 |
| Optum Insight estimated business-disruption impact | $279 million for the three months ended March 31 | $867 million for the year ended December 31 |
The response costs included network restoration and increased medical-care expenditures as some care-management activities were suspended. The annual account also included costs associated with interest-free loans and notifying affected people. The disruption estimates reflected lost revenue while UnitedHealth maintained full readiness for the affected Change Healthcare services during the disruption. That readiness did not mean the services were fully operational. Loan principal is not interchangeable with those expense categories. In the annual report, UnitedHealth said it had restored or replaced the majority of affected services, but expected further response costs and disruption impacts, to a lesser extent, in 2025. First-quarter report · 2024 annual report
A substantial recovery with continuing uncertainty
The initial undetermined materiality assessment was followed by quantified costs, a population estimate, and substantial service recovery. Editorial interpretation: the sequence shows why an early statement of uncertainty should not be treated as a final finding of limited impact. The annual report still warned of possible adverse effects from data issues, litigation, reputation, and regulatory action. These selected disclosures do not supply an independently verified attacker attribution, final affected-person count, or final resolution of every consequence. Initial filing · March amendment · First-quarter report · 2024 annual report
Sources
Initial filing — February 22, 2024; event reported February 21.
First amendment — March 8, 2024.
Second amendment and attached statement — April 24 filing / April 22 statement.
Quarterly report — May 9, 2024; period ended March 31.
Annual report — February 27, 2025; year ended December 31, 2024.