190 million people hit by Change cyberattack

Over half the US population was affected by the Change Healthcare cyberattack last February, according to a statement from its parent company UnitedHealth Group.

While United had told the federal government in October that 100 million people were hit by the attacks, an updated estimate on Monday put that number at 190 million.

Change Healthcare, a payment processor, didn’t answer emailed questions about the reason behind the different estimates, though it said in a statement that it was “not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis.”

The company said the “vast majority” of people affected were given notice, according to the statement.

Last March, the American Hospital Association called the Change incident “the most significant and consequential incident of its kind against the US healthcare system in history.” The second biggest cyberattack was against Elevance Health in 2015, according to Modern Healthcare, which affected an estimated 78.8 million people in the US.

The Change cyberattack had significant impacts on the healthcare economy. First Health Advisory, a digital health risk assurance company, estimated last March that the attack cost healthcare providers $100 million each day in the first weeks after the breach.

Further, United reported in an earnings report it had spent $3.1 billion responding to the breach last year.