Technology

Change Healthcare ransomware attack exposes personal health information of over 100 million

Published

1 year ago

October 28, 2024

Press Room

Change Healthcare ransomware attack exposes personal health information of over 100 million

Join Fox News for access to this content

You have reached your maximum number of articles. Log in or create an account FREE of charge to continue reading.

By entering your email and pushing continue, you are agreeing to Fox News’ Terms of Use and Privacy Policy, which includes our Notice of Financial Incentive.

Please enter a valid email address.

Over the past few months, we’ve seen a wave of data breaches affecting millions of people, from health care giants to government contractors and more. This latest incident is yet another in a long line of alarming breaches. Change Healthcare experienced a major data breach in February this year, causing widespread disruption across the U.S. health care sector. At the time, the company did not specify how many people were affected by the breach but hinted that it might impact well more than one-third of the U.S. population, marking one of the largest known digital thefts of medical records to date.

The owner of Change Healthcare, UnitedHealth Group (UHG), has now confirmed for the first time that more than 100 million people had their personal information and health care data stolen in what was a ransomware attack.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

UnitedHealth Group confirmed for the first time that more than 100 million people had their personal information and health care data stolen. (Kurt “CyberGuy” Knutsson)

Timeline of the Change Healthcare cyberattack

The Change Healthcare cyberattack happened in February, with news going public on Feb. 21. To contain the breach, the company took its systems offline, which led to immediate disruptions across the U.S. health care sector that relies on Change’s services for claims processing, payments and data sharing. UHG CEO Andrew Witty told Congress in May that “maybe a third” of Americans’ health data was exposed in the attack.

A month later, Change Healthcare sent out a data breach notice confirming that the February ransomware attack exposed a “substantial quantity of data” affecting many Americans. UnitedHealth Group started notifying impacted individuals in late July, with notifications continuing through October, and the final tally of those affected was released this month.

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) data breach portal updated the total number of impacted people to 100 million: “On October 22, 2024, Change Healthcare notified OCR that approximately 100 million individual notices have been sent regarding this breach,” reads an updated FAQ on the OCR website.

The February ransomware attack exposed a “substantial quantity of data” affecting many Americans. (Kurt “CyberGuy” Knutsson)

THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION

What data got stolen?

There’s roughly a 30% chance your personal data was compromised in this breach. Change Healthcare is one of the largest handlers of health, medical data and patient records, and in 2022 it merged with U.S. health care provider Optum as part of a deal with UHG, bringing the two giants together under UHG’s umbrella.

This merger gave Optum – already managing physician groups and providing tech and data to insurers and health care services – broader access to the patient records handled by Change. Overall, UHG offers benefit plans to more than 53 million customers in the U.S. and another 5 million globally, while Optum serves about 103 million U.S. customers.

The stolen data varies by individual but includes personal information such as names, addresses, dates of birth, phone numbers, email addresses and government ID numbers, including Social Security, driver’s license and passport numbers. On top of that, hackers may also have accessed health data, including diagnoses, medications, test results, imaging, care and treatment plans and health insurance information. Financial and banking details found in claims and payment data are also reportedly compromised.

Change Healthcare is one of the largest handlers of health, medical data and patient records. (Kurt “CyberGuy” Knutsson)

FROM TIKTOK TO TROUBLE: HOW YOUR ONLINE DATA CAN BE WEAPONIZED AGAINST YOU

What caused the data breach?

The Change Healthcare data breach was caused by a ransomware attack, a type of malware attack that blocks access to the victim’s personal data unless a “ransom” is paid. UHG said ALPHV/BlackCat was behind the attack, a Russian-speaking ransomware and extortion gang that later took credit for the cyberattack.

However, the attack was made possible because Change Healthcare wasn’t smart enough to protect its customers’ data with multifactor authentication. The company admitted this during a House hearing into the cyberattack in April. This raises an important question: how could a company that has billions of dollars in revenue and stores data for over 100 million Americans fail at basic cybersecurity?

UHG paid a ransom to get a decryptor and for the hackers to delete the stolen data. The ransom was said to be around $22 million and was supposed to be split between the affiliate and the ransomware operation. However, BlackCat kept it all for themselves and pulled an exit scam.

This complicated things for UHG because the affiliate claimed they still had the company’s data. They later joined forces with a new group called RansomHub, leaking some of the stolen data and extorting a second ransom from UHG.

6 ways to protect yourself from Change Healthcare data breach

1) Remove your personal information from the internet: While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. Check out my top picks for data removal services here.

2) Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.

3) Be cautious of phishing attempts: Be vigilant about emails, phone calls or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request. The best way to protect yourself from clicking malicious links that install malware is to have strong antivirus protection installed on all your devices. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

4) Monitor your accounts: Breaches of this magnitude will make it a necessity for you to start routinely reviewing your bank accounts, credit card statements and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.

5) Recognizing and reporting a Social Security scam: If there is a problem with a person’s Social Security number or record, Social Security will typically mail a letter. You can learn more about recognizing Social Security-related scams, including how to report a scam quickly and easily online to Social Security’s Office of the Inspector General, by reading more at www.ssa.gov/scams.

6) Invest in identity theft protection: Data breaches happen every day and most never make the headlines, but with an identity theft protection service, you’ll be notified if and when you are affected. Identity theft companies can monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

One of the best parts of using some services is that they might include identity theft insurance of up to $1 million to cover losses and legal fees and a white-glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.

Kurt’s key takeaway

In just 2024, with over two months still to go, we’ve witnessed countless data breaches affecting millions of Americans. This highlights how valuable your data is and how little some companies are doing to protect it. Big firms with massive revenues are struggling to implement even the most basic cybersecurity measures, practically inviting cybercriminals to hack their systems. Change Healthcare fell into this trap by not implementing two-factor authentication, leaving everything from your financial details to health data in the hands of criminals.

Do you think these companies are doing enough to protect your data and is the government doing enough to catch those behind cyberattacks? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions:

New from Kurt:

Technology

You could be sharing your Social Security number when you don’t need to

Published

6 minutes ago

March 9, 2026

Press Room

You could be sharing your Social Security number when you don’t need to

NEWYou can now listen to Fox News articles!

Some Social Security number requests are not optional. Federal reporting systems rely on the SSN as a primary identifier.

Employment offers the clearest example. Employers collect your SSN to report wages and file taxes, including Form W-2 submissions. The Social Security Administration credits your earnings record with it. The IRS uses it to match payroll taxes with reported income. Federal agencies also require your SSN when you apply for certain benefits or meet tax obligations. If you refuse to provide your SSN in these situations, you can delay processing or lose access to services.

However, not every form carries that authority. Landlords, medical offices, schools, gyms and retailers often include an SSN field by default. In those cases, ask why they need it and whether another identifier will work. So how do you tell when your SSN is truly required and when you can push back?

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Your Social Security number powers tax reporting and federal benefit systems, which is why some requests truly are mandatory. (AP Photo/Jenny Kane, File)

Examples of when you need to share your SSN

Certain U.S. laws and federal regulations require an SSN because it functions as the official taxpayer or benefits identifier.

Federal income tax returns: The IRS requires individuals who qualify for an SSN to use it as their taxpayer identification number on Form 1040 and related filings. The IRS uses the number to match income statements, credits and refunds to the correct taxpayer record.

Form W-2 wage reporting: IRS regulations require employers to include each employee’s SSN on Form W-2. Employers submit the form to both the IRS and the SSA so agencies can record earnings and reconcile payroll taxes.

Social Security retirement and disability benefits: Applications for Social Security benefits require an SSN so the SSA can retrieve the applicant’s earnings history and calculate eligibility and payment amounts.

ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS

FAFSA for federal student aid: U.S. citizens and eligible noncitizens applying for federal student aid must provide a valid SSN on the Free Application for Federal Student Aid (FAFSA). The number is verified against SSA records during processing.

Interest income reporting: Financial institutions must obtain a taxpayer identification number — usually an SSN for individuals — to report interest income to the IRS on Form 1099-INT.

In each of these cases, the requirement stems from tax administration statutes or federal benefits law. The SSN is used to link records across agencies and systems.

When you don’t need to share your SSN

Beyond tax filings, wage reporting and federal benefits, many SSN requests come from internal company policy rather than statute. Private businesses are generally allowed to ask for your SSN. In most everyday transactions, there is no federal law forcing you to provide it.

Rental applications: Landlords often request an SSN to run credit checks. Federal housing law does not mandate collecting a tenant’s SSN to lease property. Screening is conducted through consumer reporting agencies, and alternative verification methods may be available.

Medical intake forms: Healthcare providers routinely include an SSN field. Federal law does not require patients to disclose an SSN for treatment. Since 2018, Medicare cards have used randomized beneficiary identifiers instead of SSNs. These Medicare Beneficiary Identifiers (MBI) don’t include your SSN.

School enrollment forms: Public schools may request a student’s SSN, but students cannot be denied enrollment for refusing to provide one. Institutions tend to assign their own identification numbers.

TAX SEASON SCAMS 2026: FAKE IRS MESSAGES STEALING IDENTITIES

Utilities and subscription services: Power companies, mobile carriers and gyms sometimes request an SSN to evaluate credit risk or secure payment agreements. This is a risk management choice, not a statutory requirement.

In these cases, the request may feel routine. The legal footing is different from tax or benefits administration. You can ask what authority requires it and whether another form of identification will suffice.

Not every form that asks for your SSN has legal authority behind it. Many requests are simply company policy. (Kurt “CyberGuy” Knutsson)

What to ask before you hand over your SSN

If the request comes from a government agency, look for a Privacy Act disclosure statement. Federal law requires agencies to state whether providing your SSN is mandatory or voluntary, cite the legal authority for the request, and explain how it will be used. If the request comes from a private company, ask direct questions:

Is this required by federal or state law?

What will the SSN be used for?

Can you accept the last four digits instead?

Is there an alternative way to verify identity?

You can also ask how the number will be stored, whether it is encrypted and who has access to it. Collecting only what is necessary is a recognized security practice, but not every organization follows it.

What actually happens when your SSN is leaked

A leaked or stolen SSN can be used anywhere that number is treated as proof of identity.

In tax administration, the IRS processes returns based on the SSN attached to them. If a fraudulent return is filed first, the legitimate taxpayer’s electronic filing may be rejected because the number has already been used. Fixing it means paper filing and identity verification while the IRS reviews the case. The agency’s Identity Protection PIN program was introduced after years of SSN-based tax fraud.

Credit reporting works the same way. Under the Fair Credit Reporting Act framework, credit bureaus use the SSN to build and match consumer files. If credit is issued using your SSN, that account can attach to your report until you dispute it. It stays there while bureaus and lenders investigate.

Federal benefit systems also depend on the number. The SSA warns that criminals use stolen SSNs to impersonate beneficiaries and create fraudulent online accounts. An SSN does not expire or reset. Once exposed, it can continue appearing in tax filings, credit applications, or benefit records until you flag it.

How identity monitoring services help you respond faster

Identity monitoring services attempt to detect suspicious activity tied to your personal information as early as possible. Many services track credit activity across all three major U.S. bureaus and alert you to new inquiries, accounts and report changes. Some also scan known data breach datasets for exposed identifiers, including Social Security numbers.

Certain plans include identity theft insurance to cover eligible recovery costs, along with fraud resolution support to guide you through disputes and paperwork if something goes wrong.

No service can prevent every type of identity theft. The real value is early warning, knowing when and where your SSN is being used so you can act quickly before damage spreads.

How to check if your personal information was exposed

If you are unsure whether your personal information has been compromised, take action. Start with a reputable breach scan to see whether your email or other identifiers appear in known leaks. Early detection gives you more control and helps you respond before fraud escalates.

See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.

Before handing it over, ask how your SSN will be used, stored and protected. That simple pause can reduce your risk. (Kurt “CyberGuy” Knutsson)

Kurt’s key takeaways

Lawmakers created the Social Security number to track earnings and administer benefits, not to unlock every part of your life. Yet today, many companies treat it like a universal key. In some situations, you must provide your SSN. Taxes, employment and federal benefits depend on it. However, many everyday requests come from internal company policies, not federal law. That distinction matters. Before you share your number, pause and ask why the business needs it. Ask how they store it. Ask whether another form of identification will work. Small questions can prevent big problems. If someone has exposed your SSN, act quickly. Monitor your credit. Set up alerts. Report suspicious activity right away. Early action limits damage and protects your identity. Your Social Security number does not change. But you control when, where and how you share it.

Have you ever been asked for your Social Security number in a situation that didn’t feel necessary, and did you push back? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Technology

Apple is going high-end with new ‘Ultra’ products next

Published

12 hours ago

March 9, 2026

Press Room

Apple is going high-end with new ‘Ultra’ products next

Fresh off launching the low-cost MacBook Neo, Apple is reportedly preparing at least three new products that will fit into its highest-end “ultra” lineup. According to Bloomberg’s Mark Gruman, the next batch of releases may not bear the “ultra” name, like its Watch, but will all command price premiums over their mainline counterparts.

There’s the oft-rumored foldable iPhone, which is expected to cost around $2,000, and a touchscreen MacBook Pro is supposedly slated for the fall. Those are pretty straightforward plays for the higher end of the market. More interesting are the next-gen AirPods, which are rumored to include cameras to feed visual context to Siri. Since AirPods already use the Pro and Max branding, similar to Apple Silicon, a set of AirPods Ultra could very well be on the docket.

Between the Neo and multiple foldables in the works, it seems that Apple is simultaneously trying to go further up- and down-market.

Technology

Meta smart glasses privacy concerns grow

Published

12 hours ago

March 9, 2026

Press Room

Meta smart glasses privacy concerns grow

NEWYou can now listen to Fox News articles!

Smart glasses promise a future where technology blends into everyday life. You can ask a question, snap a quick video or identify what you are looking at in seconds. It sounds convenient. However, a new investigation suggests the experience may come with a privacy tradeoff many users never expected.

According to an investigation by Swedish newspapers Svenska Dagbladet and Göteborgs-Posten, contractors reviewing AI data in Nairobi, Kenya, may have seen highly personal footage captured by Meta’s AI-powered smart glasses. In some cases, the videos reportedly showed bathroom visits, sexual activity and other intimate moments.

The allegations have already sparked legal action and renewed debate about how AI systems are trained.

CEO Mark Zuckerberg sported a pair of Meta Ray-Ban Display AI glasses while speaking at an event in Menlo Park, California, on Sept. 17, 2025. (David Paul Morris/Bloomberg via Getty Images)

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

Report claims Meta smart glasses captured private moments

The investigation focused on people who work as AI annotators. These workers review images, video or audio so artificial intelligence systems can better understand what they are processing. In simple terms, they help train the AI. Workers interviewed for the report said they sometimes review video captured by Meta’s smart glasses. According to the investigation, the footage can include extremely personal scenes recorded in everyday environments. One annotator told reporters they see everything from living rooms to naked bodies. Another worker said faces are supposed to be blurred automatically in the footage. However, the blurring reportedly fails at times, leaving some identities visible. In some clips, workers also said they could see credit cards or other sensitive details.

Why human reviewers analyze Meta smart glasses data

Many people assume AI systems learn entirely on their own. In reality, human reviewers often play a major role in training them. AI annotators help label what appears in images, identify spoken words and verify whether an AI response is correct. Without that human input, the system struggles to improve. Meta’s smart glasses include an AI assistant that answers questions about what a user is seeing. For example, a wearer might ask the glasses to identify a landmark or explain what an object is. To make those answers accurate, the system sometimes relies on training data reviewed by humans.

Meta responds to smart glasses privacy concerns

Meta says media captured by its smart glasses remains on the user’s device unless the user chooses to share it.

A Meta spokesperson provided the following statement to CyberGuy:

“Ray-Ban Meta glasses help you use AI, hands free, to answer questions about the world around you. Unless users choose to share media they’ve captured with Meta or others, that media stays on the user’s device. When people share content with Meta AI, we sometimes use contractors to review this data for the purpose of improving people’s experience, as many other companies do. We take steps to filter this data to protect people’s privacy and to help prevent identifying information from being reviewed.”

Ray-Ban Meta glasses include an LED indicator light that activates whenever photos or videos are recorded, helping signal to people nearby that content is being captured. The company’s terms of service also state that users are responsible for following applicable laws and using the glasses in a safe and respectful manner. That includes avoiding activities such as harassment, infringing on privacy rights or recording sensitive information.

Meta has also been in contact with Sama, a company that provides AI data annotation services. According to information shared by Meta, Sama said it is not aware of workflows where sexual or objectionable content is reviewed or where faces or sensitive details remain consistently unblurred. Meta is continuing to investigate the matter.

Meta CEO Mark Zuckerberg appears at the Dirksen Senate Office Building in Washington, D.C., on Jan. 31, 2024, to testify before the Senate Judiciary Committee alongside other social media executives. (Matt McClain/The Washington Post via Getty Images)

Privacy policy changes added to the concern

The controversy arises as Meta has expanded the capabilities of its AI glasses. The glasses, created with eyewear giant EssilorLuxottica, include a camera and an AI assistant that responds to voice questions. Sales have surged. The company reportedly sold more than 7 million pairs in 2025, a dramatic increase compared with earlier years. At the same time, Meta updated its privacy policies. One change keeps the AI camera features active unless users turn off the Hey Meta voice command. Another removes the ability to opt out of storing voice recordings in the cloud. For privacy advocates, those changes make the investigation more troubling.

FACIAL RECOGNITION GLASSES TURN EVERYDAY LIFE INTO CREEPY PRIVACY NIGHTMARE

What this means to you

If you use smart glasses or similar wearable technology, the report highlights an important reality. AI devices often collect more information than people realize. When people share content with AI systems, human reviewers may analyze that material to help improve the technology. That means the footage captured by your device may be seen by someone else during the training process. Wearable cameras also record everyday life, which makes it easy for private or sensitive moments to be captured unintentionally. Even when companies use tools to blur faces or hide identifying details, those systems do not always work perfectly. As a result, personal information can sometimes still appear in the footage. Privacy policies also evolve as companies roll out new AI features. Staying aware of those updates can help you decide how comfortable you are with the technology you are using.

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com

Mark Zuckerberg wears the Meta Ray-Ban Display glasses while speaking at the company’s headquarters in Menlo Park, California, on Sept. 17, 2025. (Reuters/Carlos Barria)

Kurt’s key takeaways

Smart glasses are quickly moving from novelty to everyday gadget. The idea of having AI help you understand the world around you is undeniably appealing. However, the same technology that makes these devices powerful also raises complicated privacy questions. Cameras that are always within reach, AI systems that learn from real-world footage and human reviewers who help train those systems create a chain of data that many users rarely think about. As smart wearables become more common, transparency about how that data is used will matter more than ever.

So here is the bigger question. Would you feel comfortable wearing AI glasses if someone halfway around the world might review the footage your device captures? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter