In a shocking update, UnitedHealth has revealed that a ransomware attack on its Change Healthcare unit earlier this year affected nearly 190 million Americans—almost double the company’s initial estimate. This makes it the largest medical data breach in U.S. history, with far-reaching consequences for patients and healthcare providers alike.

The breach, which occurred in February 2024, caused widespread disruptions across the U.S. healthcare system. Change Healthcare, a major player in health data processing and insurance claims, was targeted by hackers who stole sensitive information, including names, addresses, Social Security numbers, and even medical records like diagnoses and treatment plans. Some of this data was later published online by the cybercriminals.

UnitedHealth has assured the public that most affected individuals have already been notified. The company also stated that there’s no evidence of the stolen data being misused so far. However, the sheer scale of the breach has raised serious concerns about the security of personal and medical information.

The attack has been linked to ALPHV, a notorious Russian-speaking ransomware group. According to reports, the hackers gained access to Change Healthcare’s systems using stolen credentials that lacked multi-factor authentication—a basic security measure. In an attempt to contain the damage, Change Healthcare reportedly paid at least two ransoms to prevent further leaks.

This incident highlights the growing threat of cyberattacks on critical infrastructure, especially in the healthcare sector. As UnitedHealth works to finalize the details and report them to the Office for Civil Rights, the breach serves as a stark reminder of the need for stronger cybersecurity measures to protect sensitive data.

For now, affected individuals are advised to monitor their accounts and credit reports closely for any signs of suspicious activity. Stay tuned for updates as this story continues to unfold.