The “100 million” Change Healthcare breach figure is no longer the company’s latest estimate. In January 2025, UnitedHealth said Change Healthcare estimated that approximately 190 million individuals were potentially impacted by the February 2024 ransomware attack. The estimate is approximate, may include duplicate records, and is not a confirmed count of 190 million unique Americans. It also does not establish that every person’s complete medical history was stolen.
What the 190-million estimate means
UnitedHealth’s figure is a company-reported estimate of individuals represented in affected data. One person can appear in multiple claims, pharmacy, insurance, provider, or payment records, so the total may count the same individual more than once. It is also different from the number of people who received an individual notice, the number whose Social Security numbers were exposed, and the number who experienced fraud.
As an Amazon Associate I earn from qualifying purchases.
The most accurate description is: Change Healthcare estimated that approximately 190 million individuals were potentially impacted, subject to duplicate records and final confirmation. Do not describe the figure as 190 million stolen medical charts or as an exact count of unique U.S. residents.
UnitedHealth said its review found files containing protected health information (PHI) and personally identifiable information (PII). It reported that, in the material reviewed, it had not seen doctors’ charts, full medical histories, or electronic medical-record databases. That statement limits what the company had identified; it does not mean that no health-related information was involved. UnitedHealth’s April 2024 update and its 2025 annual-meeting FAQ provide the company’s descriptions.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
How the number changed
| Date | What was reported | How to interpret it |
|---|---|---|
| February 21, 2024 | UnitedHealth disclosed a cyberattack against Change Healthcare. | The incident began as a ransomware and systems-outage crisis. |
| April 22, 2024 | UnitedHealth said files containing PHI or PII could cover a substantial portion of people in the United States. | The review was preliminary and was not yet an official breach notification. Company update |
| Late 2024/early 2025 | The HHS breach portal displayed an approximately 100-million-person report. | This earlier figure drove many headlines. HHS’s portal covers reportable breaches involving 500 or more individuals. HHS breach portal |
| January 2025 | Change Healthcare revised its estimate to approximately 190 million individuals. | UnitedHealth said the number likely includes duplicates and remained subject to confirmation. UnitedHealth FAQ |
What happened in the Change Healthcare attack?
Change Healthcare, a UnitedHealth Group subsidiary, handles claims, payment, pharmacy, prescription, and other administrative transactions for healthcare organizations. In February 2024, a ransomware attack disrupted those services nationwide. The Congressional Research Service describes the incident and its policy consequences in its timeline and analysis.
BlackCat/ALPHV claimed responsibility, according to congressional research and contemporaneous reporting. UnitedHealth CEO Andrew Witty told Congress that attackers entered through a Change Healthcare Citrix portal without multifactor authentication (MFA). That is testimony about the company’s account of the intrusion, not a final independent forensic or regulatory finding. Witty also testified that UnitedHealth paid approximately $22 million in bitcoin. See the House hearing materials and Associated Press report.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
What information may have been exposed?
Personal and health information
- PII: names, addresses, dates of birth, Social Security numbers, and other identifiers where present in affected files.
- PHI: insurance, claims, payment, prescription, diagnosis, treatment, or other healthcare-related information.
- Administrative and financial records: claims and payment data can reveal relationships among patients, providers, insurers, medications, and procedures.
The public record supports saying that affected files contained PHI and/or PII. It does not support saying every affected person had the same data exposed or that all 190 million had complete medical records taken.
What has not been established
Public information does not provide a final unique-person count, a complete list of data elements for every individual, or proof that every affected record was exfiltrated or misused. UnitedHealth has said it had not identified misuse in its review; that is not proof that misuse is impossible or that every form of misuse would already be visible.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Why patients and providers felt the outage
The incident was both a privacy event and an operational failure. Change Healthcare’s systems support:
- insurance-claim submission and adjudication;
- electronic prescribing and pharmacy transactions;
- prior authorization;
- payment transmission and provider revenue cycles; and
- access to medication and care when transactions could not be completed.
Consequently, a person could experience a delayed prescription or a provider could miss payments even without evidence that the person’s data was misused. CMS described temporary flexibilities and alternative payment or clearinghouse pathways for affected programs in its response guidance.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
What consumers should do now
- Read every relevant notice. Check messages from Change Healthcare, UnitedHealth, your health plan, provider, pharmacy, employer-sponsored plan, or another organization that handled your records. A missing notice does not prove you were unaffected; notification responsibility can differ among covered entities and business associates.
- Use only verified contact channels. Find support details in a notice or on the organization’s official website. Treat unsolicited calls, texts, and emails offering breach help as possible phishing. Do not give an unverified caller your Social Security number, insurance credentials, or payment details.
- Inspect explanation-of-benefits (EOB) statements and insurer portals. Look for unfamiliar providers, prescriptions, procedures, dates, or claims. Contact the insurer or provider shown on a suspicious entry and request correction of inaccurate records.
- Freeze your credit. A freeze can help stop new creditors from opening accounts in your name. Consumers generally must place freezes separately with Equifax, Experian, and TransUnion.
- Review credit reports and financial accounts. Check for unfamiliar accounts, inquiries, collections activity, address changes, and unauthorized transactions. A freeze does not stop medical-claim fraud or correct health records.
- Report suspected identity theft. Start with the Federal Trade Commission’s free recovery process at IdentityTheft.gov. Keep copies of notices, disputed claims, correspondence, and requested corrections.
- Secure accounts that could be used to impersonate you. Change reused passwords for email, banking, health-plan, pharmacy, and patient-portal accounts; enable MFA; and secure account-recovery email addresses and phone numbers. Password changes cannot make already-copied PHI or PII private again.
Paid monitoring may provide centralized alerts or restoration assistance, but monitoring is not prevention. It may not detect altered medical records, fraudulent insurance claims, or prescription misuse promptly. Free freezes, account reviews, and insurer contact are often the more direct first steps.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What healthcare providers and plans should review
- Determine whether Change Healthcare or another business associate handled the organization’s data, and review business-associate agreements and notification duties.
- Preserve incident records, access logs, claims logs, payment records, and communications.
- Reconcile claims and payments submitted during the outage and investigate changed payment instructions or unusual account activity.
- Require MFA for remote-access portals, VPNs, administrative accounts, and third-party connections.
- Segment critical systems, maintain tested offline backups, and establish alternative claims and payment routes instead of relying on one clearinghouse.
- Reassess vendor access after mergers, acquisitions, and system integrations.
HHS has reminded entities working with Change Healthcare and UnitedHealth of HIPAA Privacy, Security, and Breach Notification responsibilities and opened investigations into Change Healthcare and UnitedHealth Group. Details are in HHS’s frequently asked questions.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
What remains unresolved
- the final number of unique individuals after duplicate records are removed;
- which specific data elements belonged to each person;
- whether particular records were exfiltrated, merely accessible, or later misused;
- the final scope and conclusions of HHS’s investigations; and
- the extent of downstream medical or financial identity theft.
Those open questions are why “approximately 190 million potentially affected individuals” is more defensible than a definitive statement that 190 million people had their complete medical records stolen.
Frequently Asked Questions
Does 190 million mean 190 million unique Americans?
No. UnitedHealth said the approximate estimate likely includes duplicate individuals, so it should not be treated as an exact unique-person count.
Should I buy paid identity-theft monitoring?
Not automatically. Start with free credit freezes, credit-report and EOB reviews, insurer contact, and IdentityTheft.gov. Paid monitoring can add alerts or restoration help but cannot prevent all medical identity theft.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
