Change Healthcare, 100 million notices: aggregation on a single supplier

On 22 October 2024 Change Healthcare reported about 100 million notices for February's attack; the final count is 192.7 million. The analysis: concentration, dependent business interruption, notification, ransom and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, October 2024 · by cybercoverinsurance

On 22 October 2024 Change Healthcare told the US health regulator that it had sent about 100 million individual notices for the data stolen in February's ransomware attack. It was the first official figure. On 31 July 2025 the final count reached 192.7 million people. A few days before the notice, the parent company UnitedHealth Group had raised its estimate of the attack's costs for 2024 alone to about 2.87 billion dollars.

Change Healthcare is the textbook case of aggregation on a single supplier. A company little known to the public handled a huge share of US healthcare payments. When it stopped, tens of thousands of doctors, hospitals and pharmacies lost cash flow without being breached. For cyber underwriters, the case tests three covers at once: data liability, business interruption of the insured that was hit, and the far more widespread interruption of its customers.

What is known

The attack. The attackers used stolen credentials to enter a Citrix remote access portal without multi-factor authentication. They took about 6 TB of data and encrypted systems, and the company shut down its infrastructure (BleepingComputer). Access dates back to 12 February 2024; the attack was discovered on 21 February. Optum, the group company Change belongs to, paid a 22 million dollar ransom to the BlackCat (ALPHV) group (Nixon Peabody). BlackCat vanished, keeping the whole amount. The affiliate that ran the attack moved to RansomHub and demanded a second payment (BleepingComputer).

The data. The theft includes insurance data, diagnoses, medicines, test results and images, billing and payment data, Social Security numbers and identity documents (BleepingComputer). The estimate rose from 100 million (October 2024) to 190 million and then to 192.7 million (July 2025). Change warned that the final figure may be slightly overstated, because not all duplicates could be removed (HIPAA Journal).

Concentration. According to the US Treasury's Office of Financial Research, Change handles about 2 trillion dollars of medical claims a year, an estimated 44% of the funds flowing through the healthcare system. It touches one patient record in three and serves about 189,000 providers. More than a third of its clients had contracts with exclusivity clauses (OFR).

Costs. UnitedHealth reported 872 million dollars of losses in April 2024 and, in October, an estimate of about 2.87 billion for the whole of 2024, combining response costs and business disruption (Healthcare Innovation). Optum advanced about 9 billion dollars to providers through a temporary funding assistance programme. By April 2025 it had recovered about 3.2 billion (HIPAA Journal).

Later developments. Lawsuits were consolidated in a federal proceeding in Minnesota. Providers are also challenging the repayment terms of the advances. The State of Nebraska sued in December 2024 and in November 2025 the judge denied the motion to dismiss (HIPAA Journal). As of November 2025 the federal health regulator (OCR) had not announced any outcome of its investigation (Nixon Peabody).

The supplier no one can replace

A node with 44% of the flows has no ready alternative. The OFR notes that some payers had no backup payment system and that exclusivity clauses prevented other clearinghouses from connecting. Change later waived the exclusivity, but switching clearinghouse takes time and money. For weeks, many providers had no plan B.

The damage to customers was mostly liquidity. According to an American Hospital Association survey cited by the OFR, 94% of hospitals suffered a financial impact and more than half called it significant or serious. 55% of doctors used personal funds to cover practice expenses. For a small provider, the problem was not losing revenue, but collecting it months late.

Lost liquidity is not lost revenue. Many business interruption covers indemnify lost margin, not delayed collections. Revenue that arrives three months late may trigger no indemnity at all, even if it put the insured in difficulty. Interest on bridge loans is extra expense only if the policy says so.

The three policies at stake

Change's own policy responds to its own loss and liability. Response costs, notices to 192.7 million people, business disruption and defence in the lawsuits. A loss in the billions far exceeds the capacity of any cyber programme. Most of it stays with the group.

Customers' policies respond only through dependent business interruption. Doctors, hospitals and pharmacies were not breached. Their loss comes from a supplier outage. According to Kirsten Bay, CEO of Cysurance, interviewed in July 2024, many organisations would file dependent business interruption claims, even small ones, and the cover would become more restrictive (TechTarget). Many policies limit this cover to IT suppliers, with low sublimits and long waiting periods. A healthcare payment clearinghouse may not fit the definition.

The event was classified as a cyber catastrophe. The OFR reports that PCS classified it as a cyber catastrophe, the category for events with expected insured losses above 250 million dollars. It was the second event to receive that label. The OFR adds that most business losses were not insured.

Notification and liability: the cost that grows over time

The number of people almost doubled in nine months. From 100 to 192.7 million. Each revision increased notification and support costs and the pool of potential claimants. A reserve set in October 2024 would have been too low.

Delegating notification moves the cost, not the risk. In May 2024 the federal regulator clarified that providers could delegate their notification duties to Change (Nixon Peabody). That avoided millions of duplicate notices. But each provider still had to assess its own position, and a notice handled badly by a third party can still fall back on the data owner.

Litigation takes years. Almost two years after the attack, the federal proceeding was not closed and the Nebraska case had only just passed the first hurdle. For underwriters, liability claims from health data theft have a long tail, and defence costs run well before any settlement.

A ransom paid, an extortion not ended

Payment did not buy deletion of the data. Optum paid 22 million dollars. BlackCat kept the whole amount and the affiliate took the data to another group. The case shows that a ransom guarantees neither deletion nor the end of extortion.

For the policy, the question is who decides. Extortion covers usually require the insurer's consent and a sanctions check. Is a second demand from a different actor, with the same data, a new claim or the same one? Wordings rarely say so clearly.

What to bring to renewals

Impact for insurersHigh

A single supplier with a dominant market share produced direct losses in the billions and dependent losses across tens of thousands of customers.

On the portfolio side, the Change case calls for mapping not only shared cloud providers, but also sector intermediaries: healthcare payments, dealer management systems, booking platforms. If a large share of a sector's insureds depends on a single node, the aggregation should be treated with dedicated scenarios and limits.