Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe “190 million” figure is no longer the latest official estimate. Change Healthcare reported approximately 190 million impacted individuals on January 24, 2025. A later update dated July 31, 2025, recorded by the U.S. Department of Health and Human Services (HHS), put the estimate at approximately 192.7 million. Both figures are approximate, may include duplicate people, and describe information potentially involved—not proof that every person had a complete medical record stolen.
What happened in the Change Healthcare incident?
Change Healthcare, a UnitedHealth Group company that processes healthcare claims, payments, pharmacy transactions and administrative services, says it discovered a cyberattack on February 21, 2024. Its investigation identified data exfiltration between February 17 and February 20. The company says it disconnected systems and severed connectivity after discovering the intrusion, and confirmed substantial data exfiltration on March 7.
Change Healthcare describes the event as a malicious criminal cyberattack. The company’s public notice does not establish the attacker’s identity, initial-access method or other commonly reported theories, so those details should not be treated as confirmed facts.
Change Healthcare’s incident description and support information are in its HIPAA substitute notice.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why the number changed from about 500 to 192.7 million
The first breach-report entry was not a final count. As Change Healthcare analyzed files and matched information to customers, patients, members and guarantors, both notices and the estimated number of impacted individuals increased.
| Date | Reported development |
|---|---|
| July 19, 2024 | An initial OCR report listed approximately 500 affected individuals in a CMS incident snapshot. |
| October 22, 2024 | Approximately 100 million individual notices had been sent. |
| January 24, 2025 | Approximately 130 million notices had been sent and approximately 190 million individuals were reported impacted. |
| July 31, 2025 | A later Change Healthcare update recorded by HHS reported approximately 192.7 million individuals impacted. |
The timeline appears in the CMS Change Healthcare incident snapshot and the HHS Change Healthcare FAQ.
Why “192.7 million” is not necessarily 192.7 million unique people
UnitedHealth Group has said the eventual total could include duplicate individuals and would be confirmed in a later filing. A person could appear in overlapping provider, insurer or claims datasets, so the estimate should be read as an approximate number of individuals represented in analyzed records, not a verified count of unique U.S. citizens or residents.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
It is also different from the number of notices sent. Notices and impacted-individual estimates measure separate things.
What information may have been involved?
Change Healthcare says the categories varied by individual. Potentially involved information may include:
- Names, mailing addresses, telephone numbers and email addresses
- Dates of birth
- Health-insurance, insurer and policy information
- Member, group, Medicare, Medicaid and other government-payer identification numbers
- Medical-record numbers and healthcare-provider information
- Diagnoses, medicines, test results, medical images, care and treatment information
- Claims and billing information, claim numbers and billing codes
- Account numbers, payments made and balances due
This list describes data categories that may have been present in the affected files. It does not mean every person’s record contained every category.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Social Security numbers and financial data
Change Healthcare says Social Security numbers were not impacted for the majority of potentially affected individuals. It also says that, except in rare instances, financial and banking information, payment-card data, driver’s-license or state-identification numbers and other identification numbers were not involved. “Not involved for the majority” is not the same as “never involved.”
Does the figure mean complete medical records were stolen?
No. “Impacted” means Change Healthcare estimates that information relating to an individual was potentially involved. It does not establish that a complete medical record was exposed.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUnitedHealth Group said it had not seen electronic medical-record databases in the data it analyzed and was not aware of misuse of individuals’ information resulting from the incident. Those are company statements, not an independent guarantee that no misuse will occur. Change Healthcare likewise says it is not aware of misuse.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The practical risk can still include insurance, claims and billing fraud even when a full clinical record is not present. Affected data may also concern a guarantor or another person connected to a bill rather than the patient who received care.
How to find out whether you may be affected
Check for a direct or substitute notice
Change Healthcare and affected customers sent notices on a rolling basis. A letter or email may come from Change Healthcare, a health plan, a healthcare provider or another organization that used its services. The company also published a substitute notice for people who could not be reached individually.
Ask your insurer or provider
Contact the member-services or privacy office of your health plan and the billing or privacy office of providers you used during the relevant period. Ask whether the organization used Change Healthcare and whether it has identified your information in the incident.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use official support channels
Read the current information and enrollment instructions on the Change Healthcare notice and Change Cyber Support. Not receiving a letter does not conclusively prove that your information was not involved; customer-specific records and broad substitute notices were handled differently.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What potentially affected people should do now
- Use the complimentary protection if you qualify. Change Healthcare’s notice describes two years of company-paid credit monitoring and identity-theft protection. Confirm current eligibility, enrollment terms and any deadline on the official support page before enrolling.
- Watch healthcare statements. Review explanations of benefits (EOBs), insurance claims and provider bills for services, medicines or equipment you did not receive. Credit reports will not show every type of medical-identity theft.
- Monitor financial and tax records. Check bank and credit-card accounts, credit reports and tax records for unfamiliar activity. Consider a security freeze with the major credit bureaus if identity-theft risk warrants it.
- Contact the right organization quickly. Report suspicious claims to your health plan and provider; report unauthorized transactions to your bank or card issuer; contact the relevant government agency for misuse of a government-benefit identifier.
- Document and report suspected crime. Keep copies of bills, EOBs, letters and account messages. If you believe a crime occurred, contact local law enforcement and request a police report.
- Avoid phishing. Do not enroll through unsolicited “settlement” or monitoring messages. Type the official support address yourself or call the number in the company notice.
Official support contact
The substitute notice lists Change Cyber Support at 1-866-262-5342, Monday through Friday, 8 a.m. to 8 p.m. Central Time, and references a TransUnion/IDX enrollment route. Hours, pages and enrollment dates can change, so verify the current details at changecybersupport.com.
What providers and health plans need to know
Under HIPAA’s Breach Notification Rule, covered entities and business associates have duties when unsecured protected health information is breached. HHS says affected covered entities must notify individuals without unreasonable delay, notify the HHS secretary and notify the media when a breach affects more than 500 residents of a state or jurisdiction.
HHS says UnitedHealth offered to make notifications and perform related administrative work for affected providers or customers. That offer does not eliminate each organization’s obligations; responsibility and delegation must be handled under the applicable HIPAA arrangements. The HHS FAQ explains the framework.
Recommended Free Tools
Quick Recap
What remains uncertain
- The 192.7 million figure is the latest estimate identified in the HHS record cited here, not a final independently confirmed count.
- Duplicate records may be included.
- The public notices do not provide a personalized list of exactly which data elements were exposed for each person.
- A statement that no known misuse has been observed is not a prediction about future misuse.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
