Historical disclosure revision 2
Disclosures and evidence
Revision 2 of 2 · Evidence cutoff Feb 27, 2025, 12:00 AM UTC
8 prior statements preserved · 25 statements added. Attributed source statements retain the source’s qualifications.
What the company disclosed
UnitedHealth Group Incorporated stated: “On February 21, 2024, UnitedHealth Group (the “Company”) identified a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company proactively isolated the impacted systems from other connecting systems in the interest of protecting our partners and patients, to contain, assess and remediate the incident.”
UnitedHealth Group Incorporated stated: “As an update to the Original Report, the Company identified that cybercrime threat actors had gained access to certain Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company isolated the impacted systems from other connected systems in order to protect the Company’s partners and customers. The Company promptly notified customers, law enforcement and government agencies.”
Operational impact
UnitedHealth Group Incorporated stated: “During the disruption, certain networks and transactional services may not be accessible. The Company is providing updates on the incident at https://status.changehealthcare.com/incidents/hqpjz25fn3n7 . Please access that site for further information.”
Reported data impact
UnitedHealth Group Incorporated stated: “The Company is making substantial progress in mitigating the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and certain Change Healthcare services. The Company’s focus has been on ensuring patient access to care and medications by addressing challenges to pharmacy, medical claims and payment services targeted by the attack. The Company is working tirelessly to restore affected services and resume normal operations and along with law enforcement is investigating the extent of impacted data. The Company continues to believe the issue is specific to Change Healthcare. All other systems across the Company are operational.”
UnitedHealth Group Incorporated stated: “Based on initial targeted data sampling to date, the company has found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America. To date, the company has not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.”
UnitedHealth Group Incorporated stated: “The company, along with leading external industry experts, continues to monitor the internet and dark web to determine if data has been published. There were 22 screenshots, allegedly from exfiltrated files, some containing PHI and PII, posted for about a week on the dark web by a malicious threat actor. No further publication of PHI or PII has occurred at this time.”
UnitedHealth Group Incorporated stated: “In April 2024, we also announced that based on initial targeted data sampling to date, we have found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America. The investigation of impacted data is ongoing. It is possible that future risks and uncertainties resulting from the Change Healthcare cyberattack, including risks related to impacted data, litigation, reputational harm, and regulatory actions could adversely affect our financial condition or results of operations.”
UnitedHealth Group Incorporated stated: “We have determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million. The vast majority of those people have already been provided individual or substitute notice. The final number will be confirmed and filed with the Office for Civil Rights. Change Healthcare is not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis. It is possible that future risks and uncertainties resulting from the Change Healthcare cyberattack, including risks related to impacted data, litigation, reputational harm, and regulatory actions could adversely affect our financial condition or results of operations.”
Reported affected population
UnitedHealth Group Incorporated stated: “We have determined the estimated total number of individuals impacted by the Change Healthcare cyberattack is approximately 190 million. The vast majority of those people have already been provided individual or substitute notice. The final number will be confirmed and filed with the Office for Civil Rights. Change Healthcare is not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis. It is possible that future risks and uncertainties resulting from the Change Healthcare cyberattack, including risks related to impacted data, litigation, reputational harm, and regulatory actions could adversely affect our financial condition or results of operations.”
Financial impact, scope and period
UnitedHealth Group Incorporated stated: “We have made substantial progress in mitigating the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and certain Change Healthcare services. To support care providers, we accelerated funding and provided interest-free loans of approximately $3.9 billion through March 31, 2024, which has increased to over $6.5 billion through April 30, 2024. For the three months ended March 31, 2024, we incurred $593 million of direct response costs, including network restoration and increased medical care expenditures, as we suspended some care management activities to help care providers with their workflow processes. Optum Insight also experienced estimated business disruption impacts of $279 million for the three months ended March 31, 2024, reflecting lost revenue while maintaining full readiness of the affected Change Healthcare services. We expect to continue to incur direct response costs and experience business disruption impacts over the remainder of the year, including costs to continue to restore Change Healthcare’s services and the impact of suspended care management activities.”
UnitedHealth Group Incorporated stated: “We have made substantial progress in mitigating the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and certain Change Healthcare services. To support care providers, we accelerated funding and provided interest-free loans of approximately $3.9 billion through March 31, 2024, which has increased to over $6.5 billion through April 30, 2024. For the three months ended March 31, 2024, we incurred $593 million of direct response costs, including network restoration and increased medical care expenditures, as we suspended some care management activities to help care providers with their workflow processes. Optum Insight also experienced estimated business disruption impacts of $279 million for the three months ended March 31, 2024, reflecting lost revenue while maintaining full readiness of the affected Change Healthcare services. We expect to continue to incur direct response costs and experience business disruption impacts over the remainder of the year, including costs to continue to restore Change Healthcare’s services and the impact of suspended care management activities.”
UnitedHealth Group Incorporated stated: “We have substantially mitigated the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and restored or replaced the majority of the affected Change Healthcare services. To support care providers we provided interest-free loans of more than $9 billion through December 31, 2024. For the year ended December 31, 2024, we incurred $2.2 billion of direct response costs, including costs associated with providing interest-free loans; increased medical care expenditures, as we suspended some care management activities to help care providers with their workflow processes; network restoration; and notifications of impacted persons. Optum Insight also experienced estimated business disruption impacts of $867 million for the year ended December 31, 2024, reflecting lost revenue while maintaining full readiness of the affected Change Healthcare services. We expect to continue to incur direct response costs and experience business disruption impacts at a lesser extent in 2025 as we work to bring transaction volumes back to pre-event levels and win new business.”
UnitedHealth Group Incorporated stated: “We have substantially mitigated the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and restored or replaced the majority of the affected Change Healthcare services. To support care providers we provided interest-free loans of more than $9 billion through December 31, 2024. For the year ended December 31, 2024, we incurred $2.2 billion of direct response costs, including costs associated with providing interest-free loans; increased medical care expenditures, as we suspended some care management activities to help care providers with their workflow processes; network restoration; and notifications of impacted persons. Optum Insight also experienced estimated business disruption impacts of $867 million for the year ended December 31, 2024, reflecting lost revenue while maintaining full readiness of the affected Change Healthcare services. We expect to continue to incur direct response costs and experience business disruption impacts at a lesser extent in 2025 as we work to bring transaction volumes back to pre-event levels and win new business.”
Response
UnitedHealth Group Incorporated stated: “On February 21, 2024, UnitedHealth Group (the “Company”) identified a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company proactively isolated the impacted systems from other connecting systems in the interest of protecting our partners and patients, to contain, assess and remediate the incident.”
UnitedHealth Group Incorporated stated: “The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies. At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.”
UnitedHealth Group Incorporated stated: “As an update to the Original Report, the Company identified that cybercrime threat actors had gained access to certain Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company isolated the impacted systems from other connected systems in order to protect the Company’s partners and customers. The Company promptly notified customers, law enforcement and government agencies.”
UnitedHealth Group Incorporated stated: “While this comprehensive data analysis is conducted, the company is in communication with law enforcement and regulators and will provide appropriate notifications when the company can confirm the information involved. This is not an official breach notification. The company will reach out to stakeholders when there is sufficient information for notifications and will be transparent with the process.”
Recovery updates
UnitedHealth Group Incorporated stated: “The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies. At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.”
UnitedHealth Group Incorporated stated: “The Company is making substantial progress in mitigating the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and certain Change Healthcare services. The Company’s focus has been on ensuring patient access to care and medications by addressing challenges to pharmacy, medical claims and payment services targeted by the attack. The Company is working tirelessly to restore affected services and resume normal operations and along with law enforcement is investigating the extent of impacted data. The Company continues to believe the issue is specific to Change Healthcare. All other systems across the Company are operational.”
UnitedHealth Group Incorporated stated: “Change Healthcare has made continued strong progress restoring services impacted by the event. We have prioritized the restoration of services that impact patient access to care or medication.”
UnitedHealth Group Incorporated stated: “• Pharmacy services are now back to near normal levels with 99% of pre-incident pharmacies able to process claims.”
UnitedHealth Group Incorporated stated: “• Medical claims across the U.S. health system are now flowing at near normal levels as systems come back online or providers switch to other methods of submission. Change Healthcare realizes there are a small number of providers who continue to be adversely impacted and is working with them to find alternative submission solutions and will continue to provide financial support as needed.”
UnitedHealth Group Incorporated stated: “• Payment processing by Change Healthcare, which represents approximately 6% of all payments in the U.S health care system, is at approximately 86% of pre-incident levels and is increasing as additional functionality is restored.”
UnitedHealth Group Incorporated stated: “• Other Change Healthcare services, including eligibility software and analytical tools, are being restored on a rolling basis with the active reconnection of our customers now the priority. To date, approximately 80% of Change functionality has been restored on the major platforms and products, and the company expects full restoration of other systems to be completed in the coming weeks.”
UnitedHealth Group Incorporated stated: “We have substantially mitigated the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and restored or replaced the majority of the affected Change Healthcare services. To support care providers we provided interest-free loans of more than $9 billion through December 31, 2024. For the year ended December 31, 2024, we incurred $2.2 billion of direct response costs, including costs associated with providing interest-free loans; increased medical care expenditures, as we suspended some care management activities to help care providers with their workflow processes; network restoration; and notifications of impacted persons. Optum Insight also experienced estimated business disruption impacts of $867 million for the year ended December 31, 2024, reflecting lost revenue while maintaining full readiness of the affected Change Healthcare services. We expect to continue to incur direct response costs and experience business disruption impacts at a lesser extent in 2025 as we work to bring transaction volumes back to pre-event levels and win new business.”
Disclosure timeline
UnitedHealth Group Incorporated stated: “Date of report (Date of earliest event reported): February 21, 2024”
Disclosure evolution
UnitedHealth Group Incorporated stated: “As an update to information concerning the Change Healthcare cyberattack contained in the Filed Reports, the Company issued a press release on April 22, 2024, regarding its ongoing data assessment and support for impacted individuals, support for providers and customers with notifications, and Change Healthcare service restoration progress. A copy of the press release is attached to the Amendment as Exhibit 99.1 and incorporated by reference herein.”
Qualifications and uncertainty
UnitedHealth Group Incorporated stated: “The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies. At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.”
UnitedHealth Group Incorporated stated: “As of the date of this report, the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.”
UnitedHealth Group Incorporated stated: “As of the date of this Amendment, the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.”
UnitedHealth Group Incorporated stated: “Based on initial targeted data sampling to date, the company has found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America. To date, the company has not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.”
UnitedHealth Group Incorporated stated: “Given the ongoing nature and complexity of the data review, it is likely to take several months of continued analysis before enough information will be available to identify and notify impacted customers and individuals. As the company continues to work with leading industry experts to analyze data involved in this cyberattack, it is immediately providing support and robust protections, rather than waiting until the conclusion of the data review.”
UnitedHealth Group Incorporated stated: “In April 2024, we also announced that based on initial targeted data sampling to date, we have found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America. The investigation of impacted data is ongoing. It is possible that future risks and uncertainties resulting from the Change Healthcare cyberattack, including risks related to impacted data, litigation, reputational harm, and regulatory actions could adversely affect our financial condition or results of operations.”
Disclosure sources and provenance
- U.S. Securities and Exchange Commission Filed February 22, 2024Report/event date: February 21, 2024Document form: 8-K · Item 1.05SEC HTTPS source · Retrieved Oct 7, 2026, 2:31 PM UTC · Retained Oct 7, 2026, 2:31 PM UTC
- U.S. Securities and Exchange Commission Filed March 8, 2024Report/event date: February 21, 2024Document form: 8-K/A Amendment1 · Item 1.05 and 9.01SEC HTTPS source · Retrieved Oct 7, 2026, 2:31 PM UTC · Retained Oct 7, 2026, 2:31 PM UTC
- U.S. Securities and Exchange Commission Filed April 24, 2024Report/event date: February 21, 2024Document form: 8-K/A Amendment2 · Item 1.05 and 9.01SEC HTTPS source · Retrieved Oct 7, 2026, 2:35 PM UTC · Retained Oct 7, 2026, 2:35 PM UTC
- U.S. Securities and Exchange Commission Filed April 24, 2024Statement/document date: April 22, 2024Document form: EX-99.1 to 8-K/A Amendment2 · Item 1.05SEC HTTPS source · Retrieved Oct 7, 2026, 2:35 PM UTC · Retained Oct 7, 2026, 2:35 PM UTC
- U.S. Securities and Exchange Commission Filed May 9, 2024Report/event date: March 31, 2024Document form: 10-Q · Item PartI Item2 MD&ASEC HTTPS source · Retrieved Oct 7, 2026, 2:35 PM UTC · Retained Oct 7, 2026, 2:35 PM UTC
- U.S. Securities and Exchange Commission Filed February 27, 2025Report/event date: December 31, 2024Document form: 10-K · Item 1A/1C and PartII Item7SEC HTTPS source · Retrieved Oct 7, 2026, 2:37 PM UTC · Retained Oct 7, 2026, 2:37 PM UTC
Evidence limitations
- Issuer disclosures establish what was reported, not independent incident verification.