Change Healthcare Data Breach Lawsuit - 192 Million Americans' Medical Records at Risk

The February 2024 cyberattack on Change Healthcare didn't just shut down pharmacy systems for weeks. It exposed the personal and medical data of 192.7 million Americans - nearly 60% of the US population. A federal MDL is now underway in Minnesota, and when a settlement eventually comes, it could rank among the largest data breach recoveries in US history.

What Is the Change Healthcare Lawsuit About?

Change Healthcare is a subsidiary of UnitedHealth Group. It processes roughly 15 billion medical transactions a year - insurance claims, pharmacy benefits, billing data - making it the central hub of US healthcare payments.

In February 2024, the Russian ransomware group ALPHV/BlackCat breached Change Healthcare's network. The attack reportedly exploited a server that lacked multifactor authentication. The resulting outage disrupted pharmacies, hospitals, and clinics across the country for weeks. Then came the disclosure: names, Social Security numbers, dates of birth, health insurance details, diagnoses, treatments, financial account data - all potentially compromised.

Plaintiffs' attorneys claim Change Healthcare and UnitedHealth Group failed to implement basic security controls and notified affected people too slowly. Both companies deny the allegations. No defendant has been found liable.

Who Can Join the Class Action?

Anyone whose data was compromised in the February 2024 breach may have standing - but there's no formal class or claim form yet. The MDL, In re Change Healthcare, Inc. Customer Data Security Breach Litigation, MDL No. 3108, is before Judge Donovan W. Frank in the U.S. District Court for the District of Minnesota.

As of October 2026, 153 lawsuits are pending in the MDL. The court is still in pretrial proceedings. No class has been certified, and no settlement has been announced.

What Data Was Exposed?

This wasn't one category of records. Depending on which healthcare providers and insurers used Change Healthcare's systems, affected individuals may have had any combination of the following exposed:

• Full name, address, date of birth
• Social Security number and driver's license number
• Health insurance ID and plan information
• Medical diagnoses, treatment history, prescriptions
• Billing, claims, and payment records
• Financial account numbers (in some cases)

That combination of health and financial data creates serious long-term risks - identity fraud, medical record fraud, and insurance fraud among them.

What Compensation Could Class Members Receive?

No amount has been announced. For scale: the Anthem breach, which exposed 78.8 million records, settled for $115 million in 2017. The Equifax breach (147 million people) settled for $575 million. A resolution here - affecting nearly 60% of the US population with especially sensitive medical and financial data - could dwarf both.

Any eventual settlement could include cash payments, credit monitoring, and reimbursement for documented losses. The court's next status conference is November 19, 2026, with informal mediation sessions ongoing between lead counsel and the court's appointed magistrate judge.

What Should Affected People Do Now?

Start building your paper trail. If you received a breach notice from your insurer, pharmacy, or healthcare provider, save it. Document suspicious activity: unexpected medical bills, insurance claims for care you didn't receive, or new accounts you didn't open. Those records matter when a settlement arrives.

Freeze your credit at all three bureaus - Equifax, Experian, and TransUnion - for free. UnitedHealth Group has offered credit monitoring and identity protection through a support program, though availability may vary.

Don't use any site claiming to process Change Healthcare settlement claims right now. No legitimate claim portal exists as of October 2026. ClaimActions.com will update when one opens.

Sources: U.S. District Court for the District of Minnesota, MDL No. 3108 (In re Change Healthcare, Inc. Customer Data Security Breach Litigation); openclassactions.com; settlementinsight.com; HHS Office for Civil Rights.