UnitedHealth Group’s Latest Health Data Breach Woes

•
August 7, 2025    

When you’ve been the victim of the largest health data breach in U.S. history, and you’ve been under intense public and regulatory scrutiny for months, the last thing you want to do is to report another major breach less than a year after the last one.

See Also: Post-Quantum Cryptography – A Fundamental Pillar in the Future of Cybersecurity [ES]

But that just happened to UnitedHealth Group, and members of Congress are demanding answers. Once again, UHG’s aggressive growth strategy and ability to manage risk are in the spotlight.

Back in June, Episource – a medical coding company that a lot folks until recently apparently had never heard of and had no idea it’s part of UHG – reported a hacking incident that affected 5.4 million Americans to the U.S Department of Health and Human Services.

As of Thursday, the Episource hack ranked as the second-largest health data breach reported to HHS’ Office for Civil Rights so far in 2025. But in comparison to another UHG breach – the 2024 hack on its Change Healthcare IT service unit – the Episource incident is small potatoes.

UHG’s Optum subsidiary acquired Episource in 2023, about a year after Optum purchased Change Healthcare. As of right now, ransomware group AlphV/Black Cat’s February 2024 attack on Change Healthcare seems destined to live in infamy as the single-largest HIPAA breach and most disruptive cyberattack to ever hit the U.S. healthcare sector.

Change Healthcare’s last updated public breach report to federal regulators in late 2024 said the attack compromised the protected health information of 190 million people. That’s an eye-popping number considering that another health insurer – Anthem Inc. – for years held the title for largest breach with a 2014 hacking incident that affected nearly 79 million people (see: Change Healthcare Now Counts 190 Million Data Breach Victims).

But now the victim tally of the Change Healthcare breach is even higher, climbing to 192.7 million people last week, according to UHG in a letter submitted to New Hampshire’s attorney general.

That breach represents about 57% of the U.S. population in 2024. And that’s up from UHG’s original estimate soon after the Change Healthcare ransomware attack that one-in-three Americans would be affected.

HHS OCR launched an investigation in March 2024 into the Change Healthcare incident. The HIPAA enforcement agency told ISMG on Thursday that it does not generally comment on current or open investigations, and did not immediately respond to ISMG’s request for other details related to the Change Healthcare breach.

If and when HHS OCR releases a public report about its investigation into the Change Healthcare breach or the Episource hack – perhaps in the form of a resolution agreement or civil monetary penalty against UHG – it’s probably a safe bet that findings of faulty risk analysis will be spotlighted. That’s been an ongoing weakness with the majority of HIPAA-covered firms and business associates that have been investigated by HHS OCR following breaches.

With nearly 2,700 subsidiaries and business units, UHG no doubt faces some complex challenges in conducting a comprehensive enterprise-wide HIPAA security risk analysis – and keeping it current. Could better risk analysis of Change Healthcare and Episource – either before or right after their acquisition by UHG – have picked up on some of the vulnerabilities that contributed to these hacks?

Maybe UHG has grown too large to manage all the enterprise risks. Maybe no company that large can do it, and patients should expect more of the same.

Congress has been asking these same questions for over a year, and the UHG’s latest hack is fueling a new round of government scrutiny, including questions related to due diligence and risk analysis.

Earlier this week, two U.S. senators – Bill Cassidy, R-La., and chair of the Senate committee of health, education, labor and pensions – and Maggie Hassan, D-N.H. – sent a letter to UHG CEO Stephen Hemsley with questions about the Episource breach and the steps that UHG has taken to bolster security in the wake of the Change Healthcare cyberattack last year.

“The hack at Change Healthcare was due to UHG’s failure to implement multifactor authentication and upgrade legacy systems after UHG acquired Change Healthcare,” the senators wrote. “The hack on Episource, which UHG acquired in 2023, raises questions about the company’s commitment to securing PHI, given the repeated security failures at the company.”

“The failure to properly secure internal systems is particularly troubling given the wide impact that the Change Healthcare attack had on the healthcare system,” the letter said. “The risk of cyberattacks continue to threaten the healthcare sector. We have seen the recent threat that hostile actors including Iran may pose on healthcare entities, and UHG’s repeated failures to protect against such attacks jeopardizes patient health.”

The lawmakers demanded that UHG provide answers to a list of about 10 questions, including whether UHG made any changes – and the types of changes – in how it conducts due diligence for companies it acquires to consider security risks.

The senators asked UHG to respond to their inquiry by Aug. 18.

UHG in a statement to ISMG said the company received the senators’ letter and “looks forward” to providing them the information.

“On February 6, 2025, Episource discovered that a cyber event occurred within its platform, and we took immediate steps to mitigate the risk and report the matter to law enforcement and customers. The incident was isolated to the Episource environment,” the statement said.

UHG did not immediately respond to ISMG’s other questions about the Episource incident and the latest developments related to the Change Healthcare breach.

Cassidy and Hassan’s letter is just the latest Congressional probing of UHG’s security practices following the Change Healthcare attack.

UHG CEO Andrew Witty – who has since resigned – was grilled by two Congressional committees last May about the security failures that led to the Change Healthcare attack.

That incident not only compromised millions of American’s data, but also practically shut down much of the U.S. healthcare sector’s business processes for months, forcing some smaller medical care providers to eventually close their operations as claims payments and other critical activities came to a standstill.

UHG provided about $9 billion in financial assistance to help affected entities that felt the cash crunch during Change Healthcare’s massive IT outage, but those loans were temporary and some – including the Wall Street Journal – have reported that the company has sent out threatening letters shaking down still-struggling providers for repayment.

Of course the latest round of examination of UHG and its data security practices is one many other thorny issues the company has been dealing with in the last year or so.

The most somber was the assassination of Brian Thompson, CEO of UHG’s United HealthCare unit, in mid-Manhattan last December as he was walking to a company meeting. That shocking incident immediately unleashed a tidal wave of public furor over UHG’s alleged “deny, defend and depose” practices to avoid paying medical claims. (see: CEO’s Murder Sparks Outcry Over UHC’s Coverage Denials).

Besides those related to the data breaches, UHG is also facing scores of lawsuits and regulatory probes on a variety of other matters, from the company’s use of artificial intelligence tools for allegedly unfairly refusing to authorize coverage of various medical care – to its acquisition of certain other healthcare sector companies (see: Court: UnitedHealth Must Answer for AI Based Claim Denials).

So, what lessons have we learned from UHG? In addition to broader questions about being too big to handle the risks, it also underscores the importance of conducting a risk analysis and acting swiftly on those recommendations. In hindsight, it costs a lot less than a megabreach.

The other lesson is still playing out. How UHG responds to this latest round of scrutiny could have implications not just for its own reputation and operations, but also for the broader healthcare sector’s approach to safeguarding patient data in an era of escalating cyberthreats, rampant mergers and acquisitions and tightening cyber resources.

For the sake of trust in the healthcare sector and Americans’ sensitive health information privacy and security, let’s hope that there isn’t another data breach anytime soon that surpasses the Change Healthcare hack and makes all of UHG’s current problems seem small.