Nebraska Sues Change Healthcare Over Massive Data Breach

The Attorney General of Nebraska has filed a lawsuit against Change Healthcare, accusing the company of leaking residents’ confidential medical information and disrupting the operations of healthcare facilities following a ransomware attack in February.

The lawsuit alleges violations of Nebraska’s consumer protection and data security laws, asserting that Change Healthcare, a subsidiary of UnitedHealth Group (UHG), failed to implement adequate safeguards. This negligence, according to the complaint, exacerbated the consequences of the cyberattack, leading to significant disruptions in healthcare services.

The data breach compromised not only residents’ sensitive personal and financial information but also crippled payment processing and claims systems—critical components of the state’s medical infrastructure. These failures placed severe financial strain on healthcare facilities, particularly in rural areas, where hospitals experienced cash register outages and service delays. The lawsuit further claims that Change Healthcare failed to fulfill its obligation to notify affected individuals, leaving them vulnerable to potential fraud campaigns.

The ransomware attack on Change Healthcare ranks among the most extensive in U.S. history, affecting over 100 million Americans. The incident incapacitated critical systems of a company that processes nearly half of the nation’s healthcare claims, serving over 900,000 physicians, 67,000 pharmacies, 5,500 hospitals, and 600 laboratories. It also disrupted drug distribution and insurance services in pharmacies across the country. In Nebraska alone, the company handles millions of claims annually for more than 575,000 residents.

The attack forced a complete halt in claims processing for several weeks, leading to unfulfilled prescriptions and delayed medical care. The lawsuit also highlights instances of fraud, where patients received calls from individuals impersonating hospital representatives, requesting credit card information under the guise of refunding payments.

Healthcare providers suffered significant financial losses as they continued to deliver care without reimbursement, while recovery efforts faced prolonged delays. Large healthcare systems reportedly lost over $100 million per day during the downtime.

Despite the scale of the breach, Change Healthcare has yet to notify all affected Nebraska residents. Only after inquiries from the Attorney General did UHG issue a generic press release via email. A UHG spokesperson stated that notifications are being sent “as quickly as possible given the complexity of the data and the ongoing investigation.” The company also noted its collaboration with the U.S. Department of Health and Human Services and other regulators.

The Attorney General of Nebraska is seeking penalties, compensation, and mandatory implementation of stricter data protection measures. The lawsuit underscores the urgent need to restore trust in the healthcare system and ensure that companies uphold their responsibilities to safeguard data and promptly notify affected individuals.