This is Optimizer, a weekly newsletter sent every Friday from Verge senior reviewer Victoria Song that dissects and discusses the latest gizmos and potions that swear they’re going to change your life. Opt in for Optimizer here.
Technology
Change Healthcare ransomware attack exposes personal health information of over 100 million
Over the past few months, we’ve seen a wave of data breaches affecting millions of people, from health care giants to government contractors and more. This latest incident is yet another in a long line of alarming breaches. Change Healthcare experienced a major data breach in February this year, causing widespread disruption across the U.S. health care sector. At the time, the company did not specify how many people were affected by the breach but hinted that it might impact well more than one-third of the U.S. population, marking one of the largest known digital thefts of medical records to date.
The owner of Change Healthcare, UnitedHealth Group (UHG), has now confirmed for the first time that more than 100 million people had their personal information and health care data stolen in what was a ransomware attack.
GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE
UnitedHealth Group confirmed for the first time that more than 100 million people had their personal information and health care data stolen. (Kurt “CyberGuy” Knutsson)
Timeline of the Change Healthcare cyberattack
The Change Healthcare cyberattack happened in February, with news going public on Feb. 21. To contain the breach, the company took its systems offline, which led to immediate disruptions across the U.S. health care sector that relies on Change’s services for claims processing, payments and data sharing. UHG CEO Andrew Witty told Congress in May that “maybe a third” of Americans’ health data was exposed in the attack.
A month later, Change Healthcare sent out a data breach notice confirming that the February ransomware attack exposed a “substantial quantity of data” affecting many Americans. UnitedHealth Group started notifying impacted individuals in late July, with notifications continuing through October, and the final tally of those affected was released this month.
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) data breach portal updated the total number of impacted people to 100 million: “On October 22, 2024, Change Healthcare notified OCR that approximately 100 million individual notices have been sent regarding this breach,” reads an updated FAQ on the OCR website.
The February ransomware attack exposed a “substantial quantity of data” affecting many Americans. (Kurt “CyberGuy” Knutsson)
THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION
What data got stolen?
There’s roughly a 30% chance your personal data was compromised in this breach. Change Healthcare is one of the largest handlers of health, medical data and patient records, and in 2022 it merged with U.S. health care provider Optum as part of a deal with UHG, bringing the two giants together under UHG’s umbrella.
This merger gave Optum – already managing physician groups and providing tech and data to insurers and health care services – broader access to the patient records handled by Change. Overall, UHG offers benefit plans to more than 53 million customers in the U.S. and another 5 million globally, while Optum serves about 103 million U.S. customers.
The stolen data varies by individual but includes personal information such as names, addresses, dates of birth, phone numbers, email addresses and government ID numbers, including Social Security, driver’s license and passport numbers. On top of that, hackers may also have accessed health data, including diagnoses, medications, test results, imaging, care and treatment plans and health insurance information. Financial and banking details found in claims and payment data are also reportedly compromised.
Change Healthcare is one of the largest handlers of health, medical data and patient records. (Kurt “CyberGuy” Knutsson)
FROM TIKTOK TO TROUBLE: HOW YOUR ONLINE DATA CAN BE WEAPONIZED AGAINST YOU
What caused the data breach?
The Change Healthcare data breach was caused by a ransomware attack, a type of malware attack that blocks access to the victim’s personal data unless a “ransom” is paid. UHG said ALPHV/BlackCat was behind the attack, a Russian-speaking ransomware and extortion gang that later took credit for the cyberattack.
However, the attack was made possible because Change Healthcare wasn’t smart enough to protect its customers’ data with multifactor authentication. The company admitted this during a House hearing into the cyberattack in April. This raises an important question: how could a company that has billions of dollars in revenue and stores data for over 100 million Americans fail at basic cybersecurity?
UHG paid a ransom to get a decryptor and for the hackers to delete the stolen data. The ransom was said to be around $22 million and was supposed to be split between the affiliate and the ransomware operation. However, BlackCat kept it all for themselves and pulled an exit scam.
This complicated things for UHG because the affiliate claimed they still had the company’s data. They later joined forces with a new group called RansomHub, leaking some of the stolen data and extorting a second ransom from UHG.
6 ways to protect yourself from Change Healthcare data breach
1) Remove your personal information from the internet: While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. Check out my top picks for data removal services here.
2) Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.
3) Be cautious of phishing attempts: Be vigilant about emails, phone calls or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request. The best way to protect yourself from clicking malicious links that install malware is to have strong antivirus protection installed on all your devices. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.
4) Monitor your accounts: Breaches of this magnitude will make it a necessity for you to start routinely reviewing your bank accounts, credit card statements and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.
5) Recognizing and reporting a Social Security scam: If there is a problem with a person’s Social Security number or record, Social Security will typically mail a letter. You can learn more about recognizing Social Security-related scams, including how to report a scam quickly and easily online to Social Security’s Office of the Inspector General, by reading more at www.ssa.gov/scams.
6) Invest in identity theft protection: Data breaches happen every day and most never make the headlines, but with an identity theft protection service, you’ll be notified if and when you are affected. Identity theft companies can monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
One of the best parts of using some services is that they might include identity theft insurance of up to $1 million to cover losses and legal fees and a white-glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.
Kurt’s key takeaway
In just 2024, with over two months still to go, we’ve witnessed countless data breaches affecting millions of Americans. This highlights how valuable your data is and how little some companies are doing to protect it. Big firms with massive revenues are struggling to implement even the most basic cybersecurity measures, practically inviting cybercriminals to hack their systems. Change Healthcare fell into this trap by not implementing two-factor authentication, leaving everything from your financial details to health data in the hands of criminals.
Do you think these companies are doing enough to protect your data and is the government doing enough to catch those behind cyberattacks? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most asked CyberGuy questions:
New from Kurt: Copyright 2024 CyberGuy.com. All rights reserved.
These days, it seems I cannot escape peptides. Online, I’ve been assaulted by videos of shirtless Chads injecting dubiously sourced bottles of the so-called “Wolverine stack.” On the New York City subway, I’m haunted by Serena Williams’ Ro ads for easy GLP-1 access. Silicon Valley seems to be a parade of peptide parties. In Washington, RFK Jr. has said he’s pro-peptide and wants to expand access. In July, the FDA will meet to possibly reclassify 14 peptides so they can be eligible for compounding.
And in Hollywood, Gwyneth Paltrow — mother Goop, one of the original wellness influencers — is selling a series of peptide skincare products. Except, after some research, I’m not sure Paltrow actually understands what peptides are.
You might be wondering why I’m fixating on a Goop product in Optimizer. The short answer: While researching peptides for a forthcoming feature, I’ve descended into madness.
The longer answer is that peptide mania is central to Silicon Valley’s current fixation with longevity and metabolic optimization. As I’ve recently written, wellness trends increasingly inform new health tech features and gadgets that make up the wearable surveillance state. Peptides are also being framed on social media as an innovation that democratizes healthcare. (A similar rhetoric used to describe wearables!) It’s part of the wellness Wild West feedback loop that’s fueling Silicon Valley’s obsession with self-optimization. With that in mind, it’s worth examining how “peptide washing” has crept into various corners of the internet — and the resulting ripple effects.
While peptide shots are a relatively new trend, we’ve known about peptides and how they work for decades. They’re short chains of amino acids, which, in turn, make up proteins. In other words, building blocks for the building blocks. Because a peptide can be a chain ranging from two to roughly 100 amino acids, there are potentially trillions of peptides. Their main function is to act as messengers for various bodily functions. Some are naturally occurring and often come from the foods you eat. Others are made synthetically in a lab. The most famous ones include insulin and GLP-1 medications like semaglutide (Ozempic and Wegovy) and tirzepatide (Zepbound and Mounjaro).
What’s taking social media by storm are peptides that exist in legal gray areas. They’re not widely tested or FDA-approved drugs, and are sometimes sourced from dubious suppliers. I’ve previously written about retatrutide — another popular weight loss peptide — in Optimizer, but there’s a whole slew of others with names that sound vaguely like Star Wars droids. The most popular ones include BPC-157, TB-500, GHK-Cu, and CJC1295. These peptides are touted as biohacks for ailments ranging from fat loss and muscle growth, to faster wound healing, anti-aging, and increased energy. Essentially, everything associated with living a longer, healthier life. Lumped alongside these is NAD+, which is not a peptide but is often marketed as one. That’s partly because it’s frequently consumed as an IV drip and is thus an injectable substance.
But just because you can inject something, that doesn’t make it a peptide.
Do you have experience using peptides?
Or extremely strong feelings about this trend? I’m researching this phenomenon and I’d love to chat with you. Hit me up at victoria.song@theverge.com or on Signal at @ vicmsong.14.
NAD stands for nicotinamide adenine dinucleotide. It’s a coenzyme — basically an enzyme booster — that’s found in every cell. Its primary job is to help convert food into energy. It does this by shuttling electrons from one chemical reaction to another. As you age, your NAD levels naturally decline. This can lead to an array of conditions associated with aging, like Type 2 diabetes, lower energy levels, and saggy skin. Not to get too weedsy, but the + in NAD+ simply denotes one of two versions of the NAD molecule. (The other is NADH.)
Which, finally, brings me to the Goop Youth Boost NAD+ Peptide Rich Cream and whether Gwyneth Paltrow actually knows what a peptide is.
In my research, I was looking into influential people who have spoken out about peptide injections. There’s a long list, but in Hollywood, Paltrow’s name kept popping up. Cue this recent Elle interview, in which Paltrow plays a “fuck, marry, kill” game with wellness trends.
From the get-go, the Elle article incorrectly identifies NAD+ as a peptide. Paltrow is then quoted as saying she uses NAD+ IV drips and an injectable NAD+ pen for impromptu energy boosts. She goes on to say that injectable peptides dealing with inflammation and brain health that are “being formulated for longevity” will be the next NAD+. In the fuck, marry, kill game, Paltrow is asked to choose between NAD+, B12, and peptide shots. She refuses, saying she’d marry them all.
What’s worrisome is the conflation of these treatments, even though they’re three separate things. It’s easy for the average person to read this article and think, “NAD+ is a type of peptide shot and a rich, glamorous celebrity like Gwyneth Paltrow does it, so this must be their secret to looking good.”
(For the curious: B12 is a vitamin. Supplementation can boost energy if you have a B12 deficiency, which is relatively common in the elderly, vegetarian, and vegan populations. As for NAD+, there’s considerable research interest, but limited clinical evidence for drips or supplements at the moment. I wrote a whole Optimizer newsletter about dubious peptide shots.)
From this interview, I get the sense that Paltrow knows that peptides are trendy, but she doesn’t actually admit to using any specific one. After some more digging, I found she has stated that she loves glutathione IV drips. Now, that is a peptide. However, she characterized her usage as “I love IV drips!” so, again, I’m not sure if Paltrow is aware that IV drips and peptides are not the same thing. Upon looking into her “peptide-rich” moisturizer, I’m even less certain.
Calling it a “Youth Boost NAD+ Peptide Rich Cream” would suggest this $105 moisturizer has both NAD+ and a bunch of peptides. Peruse the ingredient list, and you’ll find it doesn’t even have NAD+. It has NMN, or nicotinamide mononucleotide, a precursor (another kind of building block) for NAD+. As for its peptide content, the marketing claims the cream features “biomimetic plant-derived peptides.” Again, the list only refers to one true peptide molecule: arginine/lysine polypeptide. (A polypeptide is a longer peptide; this one supposedly helps with wrinkles.) It also appears last. In skincare, the ingredient list is generally ordered in terms of concentration. The top three to five ingredients make up the bulk of the formula. One hack is to find the so-called “one percent line”, which you can estimate from when the first preservative or fragrance appears. Given how this list is written, this is a standard moisturizer with a teeny sprinkle of a single peptide thrown in for marketing flavor. Even if there was a more potent amount, peptides are delicate molecules. Effectiveness for any topical skincare active — be it peptides or salmon sperm DNA — depends on stable formulation, concentration, whether the molecule can penetrate the skin barrier, and packaging that prevents degradation.
In any case, I reached out to Goop to clarify the peptide content in this cream. I have not heard back.
The only thing I can conclude is Paltrow isn’t afraid to try fringe wellness trends. (That and she loves an IV drip.) If someone handed her a peptide shot with the promise of energy and youth, I’d bet she’d do it. But do I think a peptide-curious person could ask her to explain the pros and cons of this trend based on her public statements? Now that’s a bet I would not take.
I could be wrong. In which case, I find her statements and her moisturizer to be disappointing given her status and influence. Case in point, the average person likely isn’t going to go through the trouble of accessing gray market peptide vials. They probably won’t be able to afford the same quality treatments as Paltrow, either. But a so-called peptide cream from a celebrity? That’s easily accessible. And in this particular case, that consumer wouldn’t be getting much of the thing they purportedly want to try.
More concerning is the flattening of any injectable as a peptide. Paltrow showing up to a podcast with an IV drip, speaking of peptides, phospholipids, and regular vitamins in a single breath? That’s confusing. It conflates relatively harmless therapies — like vitamin supplementation — with those that aren’t as well-studied. And the more influential people do this, the more regular people will too.
Peptides aren’t inherently dangerous. Injections aren’t evil. But the way peptide mania has made a more extreme, experimental trend as casual as taking a multivitamin? That feels like the slipperiest of slopes.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
A new move from the Federal Communications Commission is being framed as a national security step. But if you already have a router at home, the bigger question is simple: how long will it keep getting security updates?
The FCC recently updated its “Covered List” to include routers produced in foreign countries, which blocks new models of that covered equipment from being approved for sale in the U.S.
At the same time, the FCC made something else clear. This change does not affect routers you already own, and it does not stop retailers from continuing to sell models that were previously approved.
So nothing shuts off overnight. However, the policy introduces a new layer of uncertainty around how long some devices will continue receiving updates.
IS YOUR HOME WI-FI REALLY SAFE? THINK AGAIN
The FCC’s router move targets future approvals, not the device already running your home Wi-Fi. Existing models can still be used and sold while update rules keep evolving. (kazakova0684/Getty Images)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
What the FCC router rule actually changed
The policy focuses on future device approvals, not the devices already in your home.
Here is what the FCC says in plain terms:
- Existing routers can still be used
- Previously approved models can still be sold and imported
- New covered models cannot receive FCC authorization
This action is tied to national security concerns about supply chain risks, not a product-by-product security test of individual routers. The key takeaway is this: your current router is not banned, recalled or disabled.
Why the FCC router rule raises update concerns
The real issue is not about using your router today. It is about future software and firmware updates. Alongside the policy change, the FCC issued a temporary waiver. That waiver allows existing routers to continue receiving updates that patch vulnerabilities, maintain functionality and ensure compatibility with operating systems. Right now, that waiver runs through at least March 1, 2027.
That date is not a guaranteed cutoff. The FCC has said it will re-evaluate the policy before then and may extend or modify the waiver. So the situation is still evolving.
How the FCC router rule could affect your router security
Your router is the gateway to everything connected in your home. Phones, laptops, smart TVs and cameras all depend on it. When a vulnerability is discovered, a software update is usually what fixes it.
If updates slow down or stop, the risk builds over time. That does not mean your router suddenly becomes unsafe. But it can become easier for attackers to exploit known flaws.
Even the FCC acknowledged this in its waiver, noting that continued updates help mitigate harm to consumers and support essential security functions. So the concern is not immediate. It is about what happens over time if support policies change.
BROWSER EXTENSIONS PUT MILLIONS OF GOOGLE CHROME USERS AT RISK
The FCC says home routers already in use can stay in use, but future support for some models now depends on waivers and conditional approvals. (deepblue4you/Getty Images)
Why the FCC is making exceptions for some routers
One important wrinkle is that the FCC has already begun granting conditional approvals for some devices. In April 2026, the agency approved certain products from NETGEAR and Adtran to continue operating under specific conditions through October 1, 2027.
That shows this is not a one-size-fits-all rule. Instead, it is an evolving policy where some devices may continue receiving support while others may face tighter restrictions.
What the FCC says about router risks and next steps
The FCC says the decision is based on national security concerns, including supply chain vulnerabilities and potential cybersecurity risks tied to certain foreign-produced equipment.
At the same time, the policy includes a path for exceptions. Companies can seek conditional approvals through federal agencies, and regulators can revisit the rules as more information becomes available.
That means the final impact will likely depend on how those decisions play out over time.
8 ways to protect your network after the FCC router rule
Until there is more clarity, a few simple steps can help keep your home network secure.
1) Check how long your router is supported
First, find your router’s exact model number. You can usually see it on a label on the bottom or back of the device. Next, go to the manufacturer’s website, such as NETGEAR, Linksys or TP-Link, and search for that model. Open its support page and look for sections like Support, Downloads, Firmware or End of Life. Then, check for a support timeline, the date of the most recent firmware update or any notes saying the product is no longer supported. If you cannot find clear information, that is a warning sign that your router may not receive regular security updates.
2) Keep your router updated
Next, log into your router settings. To do this, open a web browser and type your router’s IP address into the address bar. Common ones include 192.168.1.1 or 192.168.0.1. Then sign in using your admin username and password. Once you are in, look for sections labeled Firmware, Software Update or Administration. Check for available updates and install them if needed. If your router supports automatic updates, turn that on. This helps close security gaps quickly without you having to check manually. If you are not sure where to find these settings, you can also use your router’s mobile app if it has one, which often makes updates easier.
GET FASTER WI-FI WITH THESE SIMPLE HOME FIXES
Security updates remain the key protection for home routers as the FCC blocks new authorizations for covered foreign-produced models. (Kevin Dietsch/Getty Images)
3) Plan ahead for replacement
If your router is already a few years old, start planning for a replacement. Do not wait until updates stop. Instead, look for models with clearly stated support timelines. Check out our picks for the Top Routers for best security at cyberguy.com
4) Secure your devices as a backup layer
Your router is the first line of defense. However, your devices matter too. Keep your phone, computer and tablet updated. Also, use strong antivirus software to help catch threats that slip through. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
5) Review connected devices
From time to time, check what is connected to your network. You can do this in your router settings under “Connected Devices” or in your router’s app. If you see anything unfamiliar, remove it right away.
6) Use strong passwords
Create a strong Wi-Fi password and a separate admin password for your router. Avoid using default credentials. A password manager can help you generate and store secure logins. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com
7) Turn off remote access
First, log into your router settings using a web browser. Type your router’s IP address, such as 192.168.1.1 or 192.168.0.1, into the address bar and sign in with your admin credentials. Next, look for settings labeled Remote Access, Remote Management, Web Access from WAN, or Cloud Access. These are often found under sections like Advanced, Administration or Security. Then, turn that setting off and save your changes. This prevents your router from being accessed from outside your home network. If you cannot find the option, check your router’s mobile app or the manufacturer’s support page. Some routers hide this setting or disable it by default.
8) Restart your router regularly
First, unplug your router from the power outlet. Wait about 30 seconds to let it fully shut down. Next, plug it back in and wait a few minutes for it to reconnect to the internet. You can also restart your router through its settings. Log in, then look for options like Reboot or Restart under sections such as Administration or System. Doing this every few weeks can help apply updates and clear temporary issues that may affect performance or security. If your router supports scheduled reboots, you can turn that on to automate the process.
Kurt’s key takeaway
This is not a situation where your internet suddenly becomes unsafe. There is no recall. There is no shutdown. Your router will not stop working on a specific date. However, there is a new question mark that did not exist before. The Federal Communications Commission has created a system where future updates for some devices could depend on how the rules evolve. That puts more importance on something most people rarely think about: how long their router will stay supported. For now, you still have time. The current waiver runs into 2027, and regulators have signaled they may revisit the policy before then. The smart move is simple. Know what you own, keep it updated and stay aware as this situation develops.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
As policies around your home tech change, how much responsibility should fall on regulators versus the companies that keep your devices updated? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
On or about January 6, 2026, for example, VAN DYKE asked Polymarket to delete his Polymarket account, falsely claiming that he had lost access to the email address to which the account had been associated. That same day, VAN DYKE changed the email registered to his cryptocurrency exchange account to an email address that was not subscribed to in his name, which email address was created on or about December 14., 2025.
-
Pennsylvania1 minute agoCatchy chemistry: Pennsylvania musician sings songs about the periodic table of elements
-
Rhode Island7 minutes agoSix animals test positive for rabies in Providence County, health officials warn – What’s Up Newp
-
South-Carolina13 minutes agoStruggling South Carolina Farmers in Line for Assistance – FITSNews
-
South Dakota19 minutes agoDOC lacks population-specific programs, otherwise has ‘right things’ in place
-
Tennessee25 minutes agoTennessee basketball adds to frontcourt with Braedan Lue, Kennesaw State transfer
-
Texas31 minutes agoCarnival is Choosin’ Texas for its Newest Excel-Class Ship
-
Utah37 minutes agoGAME DAY: Golden Knights seek to retake advantage in first playoff trip to Utah
-
Vermont43 minutes agoCOMMENTARY: It’s time to invest in Vermont