Technology
UnitedHealth cyberattack exposes 190 million in largest US healthcare data breach
UnitedHealth’s Change Healthcare unit suffered a data breach in February 2024, the news of which surfaced Feb. 21.
Initially reported to have affected around 100 million individuals, the U.S. health insurance giant has now revealed that the actual number is significantly higher: 190 million. This makes it the largest breach of medical data in U.S. history, affecting nearly half the country’s population.
A breach of this magnitude can have devastating consequences for the American people as malicious actors could exploit the data for a range of attacks if it finds its way to the dark web.
I’M GIVING AWAY THE LATEST & GREATEST AIRPODS PRO 2
A doctor looking at patient’s private information (Kurt “CyberGuy” Knutsson)
The updated impact assessment
UnitedHealth confirmed on Friday, Jan. 24, 2025, that the ransomware attack on its Change Healthcare unit affected approximately 190 million people in the United States. The company had previously estimated the number of affected individuals to be around 100 million in its preliminary analysis filed with the Office for Civil Rights, a division of the U.S. Department of Health and Human Services that investigates data breaches.
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
UnitedHealth stated that the majority of those impacted have already been notified, either directly or through substitute notice. The final tally of affected individuals will be confirmed and submitted to the Office for Civil Rights at a later date.
The company tells CyberGuy it is “not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during the analysis.” However, UnitedHealth did not disclose when it became aware of the additional 90 million victims, how the revised figure was determined or what changes led to the updated number.
Illustration of a hacker at work (Kurt “CyberGuy” Knutsson)
THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION
What you need to know about the data breach
The cyberattack on Change Healthcare in February caused widespread disruptions across the U.S. healthcare sector, as the company took its systems offline to contain the breach. This shutdown impacted critical services such as claims processing, payments and data sharing, which many healthcare providers rely on.
The stolen data varied by individual but included a broad range of personal and sensitive information, such as names, addresses, dates of birth, phone numbers, email addresses and government ID numbers, including Social Security, driver’s license and passport details.
Plus, hackers may have accessed health-related information, including diagnoses, medications, test results, imaging records, care and treatment plans, and health insurance details. Financial and banking information tied to claims and payment data was also reportedly compromised.
The breach was the result of a ransomware attack carried out by ALPHV/BlackCat, a Russian-speaking ransomware and extortion group. The attack, a form of malware intrusion, locks victims out of their data unless a ransom is paid. ALPHV/BlackCat later took credit for the attack.
During a House hearing in April, Change Healthcare admitted that the breach was made possible due to inadequate security measures, specifically the absence of two-factor authentication to protect its systems.
Illustration of a hacker at work (Kurt “CyberGuy” Knutsson)
FROM TIKTOK TO TROUBLE: HOW YOUR ONLINE DATA CAN BE WEAPONIZED AGAINST YOU
6 ways to protect yourself from Change Healthcare data breach
1. Remove your personal information from the internet: The breach has exposed sensitive personal data, making it essential to reduce your online footprint. While no service can guarantee complete data removal, a reputable data removal service can significantly limit your exposure. These services systematically monitor and erase your personal information from numerous websites and data brokers. Check out my top picks for data removal services here.
2. Be wary of mailbox communications: With addresses among the compromised data, scammers may exploit this breach to send fraudulent letters. Be aware of mail claiming missed deliveries, account suspensions or security alerts. Always verify the authenticity of such communications before responding or taking action.
3. Be cautious of phishing attempts and use strong antivirus software: Scammers may use your compromised email or phone number to target you with phishing attacks. Be wary of messages asking for personal information or containing suspicious links. To protect yourself, ensure strong antivirus software is installed on all your devices. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.
4. Monitor your accounts: Given the scope of this breach, regular monitoring of your bank accounts, credit card statements and other financial accounts is critical. Look for unauthorized transactions or suspicious activity and immediately report any issues to your bank or credit card provider.
5. Recognize and report a Social Security scam: If your Social Security number is exposed, you could become a target for related scams. Official communication regarding Social Security issues usually comes via mail, not phone calls or emails. Learn more about spotting and reporting scams by visiting the Social Security Administration’s scam information page.
6. Invest in identity theft protection: Data breaches happen every day, and most never make the headlines, but with an identity theft protection service, you’ll be notified if and when you are affected. Identity theft companies can monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.
MASSIVE SECURITY FLAW PUTS MOST POPULAR BROWSERS AT RISK ON MAC
Kurt’s key takeaway
It’s surprising that a company of UnitedHealth’s scale failed to implement even basic cybersecurity measures when handling customer data. A breach affecting 190 million people – nearly half of the U.S. population – is staggering, leaving almost anyone at risk of becoming a target for hackers. While the company is still assessing the full extent of the breach, you can take precautions now by being cautious with any unknown links or unsolicited calls. Bad actors may use a variety of tactics to cause harm.
Do you think these companies are doing enough to protect your data, and is the government doing enough to catch those behind cyberattacks? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
Technology
Amazon’s Echo Hub gets a customizable new look and Ring’s AI features
Amazon’s rolling out a free software update for Echo Hub devices that gives the home screen a much-needed update to the interface it launched with in 2024. It had already added Alex Plus AI support, but the new interface has a cleaner, fully customizable layout that fits more smart home info and controls on the screen than the previous version.
The Echo Hub is also getting access to Ring AI’s Video Search feature that lets you use natural language to search through your smart home camera footage, as well as Alexa Plus summaries of detected camera events.
These are the five new features Amazon highlighted for the Echo Hub:
Organize by r …
Read the full story at The Verge.
Technology
Grandparents are identity theft’s biggest payday
NEWYou can now listen to Fox News articles!
The FBI calls it a “distress scam.” It is also known as a grandparent scam. The scam works by making an older adult believe a grandchild is in serious trouble and needs money right away, often before a court date or legal deadline. Victims reported more than $5 million in losses to this type of fraud in 2025. The FBI’s Internet Crime Complaint Center also noted that reported losses likely show only part of what scammers actually stole.
The Federal Trade Commission found in August 2025 that some of the fastest-growing scams targeting older adults use fear and urgency to override good judgment. A caller may claim your bank account was hacked and say you need to move your money immediately to protect it. However, the money does not move to safety. It goes straight to the scammer.
HOW TO HAND OFF DATA PRIVACY RESPONSIBILITIES FOR OLDER ADULTS TO A TRUSTED LOVED ONE
AI voice-cloning tools have made these scams even more convincing. Scammers can use a birthday video, voicemail or social media clip to mimic a grandchild’s voice. Then they place the call. The voice sounds familiar, the emergency feels real and the request for bail money seems urgent. The FBI counted $352 million in AI-related scam losses among victims 60 and older this past year.
Join CyberGuy Live: Lock Down Your Phone in 30 Minutes (This Saturday, June 13, 10 am ET)
- Your phone holds your email, passwords, photos, banking apps and personal data. In this free, live online class, Kurt the CyberGuy will walk you step by step through simple phone security fixes you can do in real time. You’ll learn how to improve your privacy settings, spot the latest phone scams, use trusted security tools and walk away with a simple checklist to stay protected. Register here: CyberGuyLive.com
Scammers are using stolen personal data, AI voice cloning and urgent phone calls to trick grandparents into sending money. (ljubaphoto/Getty Images)
What makes grandparents worth targeting
The same three pieces of data are required for identity verification at most banks, brokerages, pension recordkeepers, and Medicare: date of birth, last four digits of a Social Security number, and a current mailing address. For most people in their sixties and seventies, all of those accounts are open.
Those three fields have turned up in breach after breach. The Conduent Business Services breach pulled names, SSNs, dates of birth, and home addresses for more than 25 million Americans from systems that process Medicaid records and employer health plans. Texas Attorney General Ken Paxton called it the largest data breach in U.S. history in February 2026.
Americans between 65 and 74 held a median net worth of $409,900 in 2022, according to the Federal Reserve’s Survey of Consumer Finances, more than ten times the median for adults under 35. The FBI found average losses of approximately $38,500 per victim among Americans 60 and older in 2025, nearly double the figure for younger filers.
Why elder fraud losses are often underreported
Older adults reported $2.4 billion in fraud losses to the Federal Trade Commission in 2024. However, the FTC’s December 2025 report to Congress estimated that real losses may have reached $81.5 billion that year. Most cases likely went unreported.
That gap makes identity theft harder to stop. A fraudulent wire from a pension account may never alert a bank. A new credit account opened with stolen information may not reach the victim until it appears on a credit report. By then, weeks may have passed since the application was approved.
Account protections worth setting up
Scammers move fast, so it helps to set up account protections before anything goes wrong. These steps can give banks, brokerage firms and family members more ways to spot trouble early.
1) Add a trusted contact to brokerage accounts
Brokerage accounts have a protection option many account holders never activate: a trusted contact designation. Under FINRA Rule 4512, brokerage firms must ask for a trusted contact when you open or update an account. A trusted contact can be a family member, attorney or accountant. The firm can contact that person if it suspects financial exploitation or cannot reach you. However, that person cannot trade, withdraw funds or view your account balances. FINRA, the SEC and the North American Securities Administrators Association asked investors in August 2025 to contact their firm and add one. You can name more than one trusted contact. You can also change the designation at any time.
SOCIAL SECURITY ADMINISTRATION PHISHING SCAM TARGETS RETIREES
Families can help protect older adults by adding trusted contacts, verifying urgent calls and blocking online Social Security changes. (Kurt “CyberGuy” Knutsson)
2) Ask about holds on suspicious withdrawals
Under FINRA Rule 2165, brokerage firms can place a temporary hold on disbursements when they reasonably believe financial exploitation may be happening. That hold can last up to 55 business days. In January 2026, FINRA proposed extending the window to 145 business days. Ask any firm holding a pension, brokerage or annuity account about its policy on disbursements after an address change.
3) Verify urgent calls before sending money
When a caller claims a grandchild is in trouble or a federal agent needs immediate action, hang up. Then call back using a number you already have, not the number in the message. The FTC found that 41% of older adults who reported losing $10,000 or more to impersonation scams in 2024 said a phone call was the initial point of contact. That makes one simple habit especially important: verify the story before you act.
4) Block online changes to Social Security
Social Security lets you block electronic and automated telephone access to your account record. Once blocked, no one can change your direct deposit information or mailing address online or through the automated phone system. After that, any changes must go through a live SSA representative at 1-800-772-1213 or a field office visit. FINRA also operates a free Securities Helpline for Seniors at 844-574-3577, Monday through Friday, 9 a.m. to 5 p.m. ET.
Identity theft recovery is harder on your own
Even strong account protections may not catch every scam attempt. That is why identity theft monitoring and recovery support can help families respond faster when personal information gets exposed or misused.
Some identity theft protection services monitor dark web marketplaces, data broker sites and people-search sites for exposed Social Security numbers, addresses and other personal information. If fraud happens, recovery support may help contact creditors, file disputes with the three credit bureaus and organize the documentation needed to restore an identity.
OUTSMART HACKERS WHO ARE OUT TO STEAL YOUR IDENTITY
Older Americans remain prime targets for identity theft because scammers can exploit exposed Social Security numbers, birth dates and addresses. (Kurt “CyberGuy” Knutsson)
Some plans also include identity theft insurance for eligible recovery costs, such as lost wages and legal fees.
No service prevents every misuse of an older adult’s identity. However, family monitoring and fraud resolution can shorten the time between when theft happens and when you or someone in your family acts on it.
See my tips and best picks on Best Identity Theft Protection at Cyberguy.com
Kurt’s key takeaways
Grandparents have become a prime target because scammers know where the money is and how to create panic fast. A familiar voice, a stolen Social Security number or a fake emergency can turn one phone call into a devastating loss. The best defense starts before the call comes. Add trusted contacts to financial accounts, block online Social Security changes, verify urgent requests through a number you already know and talk openly with family about scam warning signs. Identity theft protection can also help spot exposed personal information and speed up recovery if fraud happens. No family can stop every scam attempt. However, a simple plan can give older adults more time, more backup and a better chance of keeping their money safe.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Is enough being done to stop scammers from using AI voices and stolen data to target grandparents? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
A warrantless wiretap law is about to expire — but surveillance networks aren’t actually ‘going dark’
Congress has failed to pass a three-week extension of Section 702 of the Foreign Intelligence Surveillance Act (FISA), with the House voting 218-198 against reauthorizing the controversial warrantless wiretapping authority through July 2nd. After a short-term extension earlier this year, the spying program now appears set to lapse for at least a week. This is the nightmare scenario FISA’s proponents have been warning about — but it doesn’t actually mean the US has lost its surveillance capabilities.
Proponents of a clean extension claim a lapse will hinder intelligence agencies’ efforts to thwart potential terrorist attacks, with surveillance networks “going dark”. Sen. Tom Cotton (R-AR) stressed the importance of reauthorizing Section 702 ahead of the World Cup. House Speaker Mike Johnson (R-LA) has said even a brief lapse would be disastrous. “Democrats in the Senate are playing political games right now with the lives of Americans,” he told reporters Wednesday. “It’s a very dangerous situation.”
In March, the FISA court recertified surveillance under Section 702 until 2027. The Brennan Center for Justice notes that a lapse won’t allow telecom companies to flout requests to hand over communications information to the NSA and other spy agencies. In 2008, after Yahoo failed to comply with a Section 702 request during a lapse, the FISA court ruled that the directives issued under Section 702 are effective while the certification is in place — even in the event of a lapse.
“The phrase ‘going dark’ is significantly misleading,” Andrea Sawka Fiegl, the senior policy director for media and technology at Common Cause, said on a Tuesday press call. Fiegl added that companies don’t choose whether they participate in surveillance under Section 702. If they don’t comply after being served with a directive, they face fines starting at $250,000 a day.
“The ‘going dark’ framing is basically a pressure tactic designed to strip Congress of its leverage to negotiate reforms by creating this false binary,” Fiegl said. “There is ample time for Congress to consider and pass reforms.”
Among those reforms are a warrant requirement for queries involving US persons, including so-called “backdoor searches” in which intelligence agencies identify a foreign target with ties to a US person, and then search that person’s communications, thus granting them access to their desired US target. Reformers also want to prohibit intelligence agencies from buying Americans’ data from private brokers to get around warrant requirements.
“Every day that Section 702 is in effect without reforms is a day that Americans’ rights are under threat,” Sen. Ron Wyden (D-OR) said in a statement Wednesday night, after Senate Republicans blocked his request for a five-week extension of Section 702 with new transparency requirements. “If there is going to be an extension of these authorities, there needs to be some guardrails or at least some transparency that would allow Congress and the American people to understand the abuses that have taken place and the need for reforms.”
Though President Donald Trump and Republican leaders in both chambers have called for a clean reauthorization of Section 702, there’s bipartisan appetite for reform — and a handful of Republican holdouts stand in the way of a clean reauthorization. Most Democrats — even some who have supported reauthorization in the past — have objected to a clean extension due to Trump’s appointment of Bill Pulte as acting director of national intelligence.
-
Virginia2 minutes agoVirginia Lottery Pick 3 Night, Pick 3 Day results for June 11, 2026
-
Washington9 minutes ago‘Attack on democracy’: Trump threatens DC home rule pending mayoral election
-
Wisconsin12 minutes ago
Wisconsin Lottery Pick 3, Pick 4 results for June 11, 2026
-
West Virginia17 minutes agoJudge Jim Douglas sworn in to West Virginia Intermediate Court of Appeals
-
Wyoming24 minutes agoWyoming officials warn summer travelers about high winds, especially RVs and trailers
-
Crypto27 minutes agoRipple and Bitso Expand Stablecoin Settlement on XRP Ledger
-
Finance32 minutes agoCrime Stoppers of Michigan could shut down while in dire financial straits
-
Fitness39 minutes agoHFA Fly-In Brings 130 Fitness Leaders to Capitol Hill to Advance Prevention, Readiness Agenda – Health & Fitness Association