Case research · Sources checked October 12, 2026
Change Healthcare / UnitedHealth Group cyberattack data breach MDL
Plaintiffs allege that on February 12, 2024 cybercriminals (the ALPHV ransomware group) entered Change Healthcare's network and, on February 21, 2024, deployed ransomware, after which Change took its platform offline for weeks. The complaints claim that the defendants failed to take adequate measures to prevent the attack and to address its consequences, and that the attackers copied and exfiltrated private information, including medical, claims and payment data, belonging to tens of millions of people.
Every line on this page is checked against the court docket and the regulators involved. We do not decide whether you are part of this case or match you with a lawyer. What we do is help you get the medical records that matter, from any provider.
- Status
- Active
- Court
- U.S. District Court for the District of Minnesota
- Docket
- MDL No. 3108; D. Minn. No. 24-md-3108 (DWF/DJF)
- Judge
- Hon. Donovan W. Frank (U.S. District Judge); Hon. Dulce J. Foster (U.S. Magistrate Judge)
- Started
- June 7, 2024
- Defendants
- UnitedHealth Group Inc., UnitedHealthCare Services, Inc., Optum, Inc. and 9 more
Where it stands
As of October 12, 2026
The MDL is in pretrial proceedings before Judge Frank. On December 19, 2025 the court granted in part and denied in part the defendants' motions to dismiss the consolidated complaints in both the Individual Patient Track and the Provider Track (the provider order lets negligence and several other claims proceed while dismissing negligence per se and HIPAA-based contract theories). As of May 29, 2026 the court reported 133 cases in the MDL and 53 related state-court cases; the JPML was still transferring tag-along actions as of August 7, 2026, and the court entered routine orders as recently as August 12, 2026. No class has been certified and no settlement has been announced in any court document reviewed.[6]
The complaint
What is alleged, and what is not decided
Plaintiffs allege that on February 12, 2024 cybercriminals (the ALPHV ransomware group) entered Change Healthcare's network and, on February 21, 2024, deployed ransomware, after which Change took its platform offline for weeks. The complaints claim that the defendants failed to take adequate measures to prevent the attack and to address its consequences, and that the attackers copied and exfiltrated private information, including medical, claims and payment data, belonging to tens of millions of people. Patient-track plaintiffs assert claims including negligence, breach of implied contract, unjust enrichment and state consumer-protection violations; provider-track plaintiffs additionally allege business disruption from the platform shutdown. Defendants deny liability; the court has made no finding of wrongdoing.
On the record
What the regulators and the court have said
- 01
HHS OCR breach report: covered entity/business associate 'Change Healthcare' filed its breach report on July 19, 2024 for a ransomware attack (hacking/IT incident) resulting in a breach of PHI; HHS's own FAQ page says the posting on the HHS Breach Portal is amended as Change updates the total. Reported counts: ~100 million notices as of Oct 22, 2024; ~190 million impacted as of Jan 24, 2025; approximately 192.7 million individuals impacted as of July 31, 2025.[9]
- 02
On March 13, 2024, OCR Director Melanie Fontes Rainer announced in a 'Dear Colleague' letter that 'OCR is initiating an investigation into this incident,' focused on whether a breach of PHI occurred and on Change Healthcare's and UHG's HIPAA compliance.[10]
- 03
HHS states that decisions about who performs breach notification are up to the affected covered entities, which may delegate notification to Change Healthcare/UHG; UHG offered to make notifications on behalf of affected providers and customers.[9]
- 04
The court's December 19, 2025 order records that 'Defendants' most recent estimate is that approximately 192.7 million individuals were impacted.'[4]
Timeline
How the case has moved
HHS Office for Civil Rights announces it is opening an investigation into Change Healthcare and UnitedHealth Group over the cyberattack and HIPAA compliance.[10]
JPML centralizes the federal cases (6 actions, with 44 potential tag-alongs across 12 districts) in the District of Minnesota before Judge Donovan W. Frank as MDL No. 3108.[1]
Change Healthcare files its breach report with HHS OCR (initially listing 500 individuals as a placeholder while the count was determined).[9]
Pretrial Order No. 1 consolidates the cases for pretrial purposes, appoints temporary interim counsel, and sets up separate 'patient' and 'provider' tracks.[2]
Change Healthcare's latest update to HHS reports approximately 192.7 million individuals impacted.[9]
Court grants in part and denies in part defendants' motions to dismiss the consolidated complaints in both the Individual Patient Track and the Provider Track.[4]
Judge Frank writes to state-court judges inviting coordination; letter reports 133 MDL cases and 53 state-court cases and a June 18, 2026 status conference.[6]
JPML transfers five more provider actions from the Middle District of Tennessee into the MDL over plaintiffs' objections.[7]
If this involves you
The records that matter, and who has them.
Whatever you decide to do next, you will be asked for these. They are yours by law, and most providers have up to 30 days to send them once they have your signed request.
Breach notification letter from Change Healthcare / UnitedHealth Group (or from your own provider or health plan)
Shows you were on the notification list, states which data elements were involved for you, and gives the enrollment code and date for any credit-monitoring offer; it is the simplest proof that your information was part of this incident.
Held by: You (mail/email); Change Healthcare / UHG notification call center; the provider or plan that sent it
Credit-monitoring / identity-protection enrollment confirmation
Documents that you enrolled in the offered protection and when, which ties your mitigation steps to the incident timeline.
Held by: You; the monitoring vendor named in your letter
Explanation of Benefits (EOB) statements and claims history for the period around and after February 2024
Change Healthcare processed claims and payments for many providers and plans; your EOBs and claims history show which of your encounters flowed through affected systems and reveal any claims you do not recognize.
Held by: Your health insurer / health plan (member portal or member services)
Your medical and billing records from providers whose claims were routed through Change Healthcare
Identifies which providers, dates of service, diagnoses and payment data could have been in the exfiltrated files, and lets you check for altered or unfamiliar entries.
Held by: Each treating provider's HIM/medical records department; provider billing office
Pharmacy fill history
Change Healthcare's pharmacy solutions were part of the affected platform; fill records establish which prescriptions and dates may have been exposed.
Held by: Your pharmacy; your pharmacy benefit manager
Credit reports and any identity-theft/fraud reports
Dated evidence of misuse (new accounts, inquiries) after the breach is what courts in this MDL have treated as a concrete present injury at the pleading stage.
Held by: Credit bureaus; FTC IdentityTheft.gov report; police report if filed
We send the request, follow up with the provider, and deliver the records to you. We don't take case details here and we never share your records with a law firm unless you tell us to.
Questions people ask
Straight answers, with sources
Is the Change Healthcare data breach lawsuit real, and where is it?
Yes. On June 7, 2024 the U.S. Judicial Panel on Multidistrict Litigation centralized the federal lawsuits as MDL No. 3108, In re: Change Healthcare, Inc. Customer Data Security Breach Litigation, in the U.S. District Court for the District of Minnesota before Judge Donovan W. Frank. The court posts its orders publicly.[1]
How many people were affected?
According to HHS, Change Healthcare's most recent update (July 31, 2025) reports approximately 192.7 million individuals impacted. The court's December 19, 2025 order cites the same figure as the defendants' most recent estimate.[9]
Has the court ruled on anything yet?
Yes. On December 19, 2025 Judge Frank granted in part and denied in part the defendants' motions to dismiss the consolidated complaints in both the patient and provider tracks; in the provider track, negligence and several other claims survived while negligence per se and HIPAA-based contract theories were dismissed. The case remains in pretrial proceedings; no class has been certified.[5]
Is there a settlement or a claim deadline?
No court document reviewed as of October 12, 2026 reports a settlement or any court-approved claims process. The MDL was still receiving newly transferred cases in August 2026.[7]
Did the government investigate?
HHS's Office for Civil Rights announced on March 13, 2024 that it was opening an investigation into Change Healthcare and UnitedHealth Group regarding HIPAA compliance and whether a breach of protected health information occurred.[10]
Who was supposed to send me a breach letter?
HHS says the covered entity (your provider or health plan) is responsible for notification but may delegate it to Change Healthcare/UHG; UHG offered to send notices on behalf of affected customers. So your letter may have come from Change Healthcare, UHG, or your own provider or plan.[9]
Sources
Where every fact on this page comes from
Primary sources only: court orders, the Judicial Panel on Multidistrict Litigation, federal regulators and state attorneys general. Each entry shows the day we opened it. This is reference material, not legal or medical advice.
- [1]MDL No. 3108 Transfer Order (In re: Change Healthcare, Inc., Customer Data Security Breach Litigation)
JPML · jpml.uscourts.gov · opened October 12, 2026
June 7, 2024 order centralizing the cases in D. Minn. before Judge Frank and summarizing plaintiffs' allegations.
- [2]Pretrial Order No. 1 (Establishing Preliminary Procedures and Appointing Temporary Interim Counsel)
U.S. District Court, D. Minn. · mnd.uscourts.gov · opened October 12, 2026
August 14, 2024 order consolidating cases for pretrial purposes and creating patient and provider tracks.
- [3]Provider Plaintiffs' Master Complaint
U.S. District Court, D. Minn. · mnd.uscourts.gov · opened October 12, 2026
Provider-track allegations about the Feb 12/21, 2024 attack, platform shutdown and data exfiltration.
- [4]Memorandum Opinion and Order on Defendants' Motion to Dismiss Provider Plaintiffs' Master Complaint
U.S. District Court, D. Minn. · mnd.uscourts.gov · opened October 12, 2026
December 19, 2025 ruling granting in part/denying in part; records defendants' 192.7 million estimate.
- [5]Letter from Judge Frank re: MDL 3108 Change Healthcare et al. (Jan. 5, 2026)
U.S. District Court, D. Minn. · mnd.uscourts.gov · opened October 12, 2026
Confirms Dec 19, 2025 motion-to-dismiss orders in both patient and provider tracks and 2026 conference dates.
- [6]Letter from Judge Frank to state court judges, Doc. 613 (May 29, 2026)
U.S. District Court, D. Minn. · mnd.uscourts.gov · opened October 12, 2026
Reports 133 MDL cases and 53 state cases; invites state-federal coordination.
- [7]MDL 3108 Transfer Order (Aug. 7, 2026)
JPML · jpml.uscourts.gov · opened October 12, 2026
Transfers five additional M.D. Tenn. provider actions into the MDL.
- [8]Order for Dismissal Without Prejudice as to Beginnings and Beyond Counseling (Doc. 707)
U.S. District Court, D. Minn. · mnd.uscourts.gov · opened October 12, 2026
Routine August 12, 2026 order showing the MDL remains active.
- [9]Change Healthcare Cybersecurity Incident Frequently Asked Questions | HHS.gov
HHS OCR · hhs.gov · opened October 12, 2026
Breach report filed July 19, 2024; updated counts culminating in ~192.7 million individuals (July 31, 2025); notification responsibilities.
- [10]Letter re: Cyberattack on Change Healthcare (OCR Director, Mar. 13, 2024)
HHS OCR · hhs.gov · opened October 12, 2026
OCR announces investigation of Change Healthcare and UHG.