UnitedHealth Confirms Hackers Stole ‘Substantial’ Amounts of Data

UnitedHealth has posted an update on a data breach that impacted its Change Healthcare subsidiary in February and brought operations across hospitals and pharmacies to a halt.

In a statement, the company said files containing protected health information or personally identifiable information that could cover a “substantial proportion of people in America” had been compromised, based on initial findings from its ongoing investigation. 

However, UnitedHealth noted that it has not seen evidence that information such as doctors’ charts or full medical histories had been jeopardized. 

In its earnings statement, the health insurance company also reported $872 million in "unfavorable cyberattack effects" from the incident.

“We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it,” said Andrew Witty, UnitedHealth Group’s CEO.  

The group added that the review was likely to take “several months” before impacted customers could be identified, due to the complexity of the data involved.

In the meantime, however, the company confirmed that impacted services have been restored, with pharmacy services and medical claims back to “near-normal” levels.

Related:Roku Cyberattack Affects 576,000 Customers

“Payment processing…is at approximately 86% of pre-incident levels and is increasing as additional functionality is restored,” the company added. “Other Change Healthcare services, including eligibility software and analytical tools, are being restored on a rolling basis with the active reconnection of our customers now the priority.”

UnitedHealth added that it expects full restoration of other systems to be completed “in the coming weeks.”