The Change Healthcare data breach: what was taken and what patients should do

Change Healthcare sits in the middle of US health care billing. It processes claims, payments and pharmacy transactions on behalf of providers and health plans, so it holds data about people who have never heard of it. According to the company's substitute notice:

• On February 21, 2024, it became aware of ransomware deployed in its computer system.
• On March 7, 2024, it confirmed that a substantial quantity of data had been exfiltrated between February 17 and February 20, 2024.
• On April 22, 2024, it publicly confirmed the data could cover a substantial proportion of people in America.

The size came later, in filings with HHS. The HHS Office for Civil Rights FAQ records that Change Healthcare reported about 100 million individual notices sent by October 22, 2024; about 190 million people impacted as of January 24, 2025; and approximately 192.7 million impacted as of July 31, 2025.

The company said it could not confirm exactly what was taken for each person. The notice says information may have included contact information (name, address, date of birth, phone, email) and one or more of:

• Health insurance information: plans and policies, insurers, member and group ID numbers, and Medicaid, Medicare and other government payer IDs.
• Health information: medical record numbers, providers, diagnoses, medicines, test results, images, care and treatment.
• Billing, claims and payment information: claim numbers, account numbers, billing codes, payment cards, financial and banking information, payments and balances.
• Other personal information: Social Security numbers, driver's license or state ID numbers, or passport numbers.

The notice says the company had not seen full medical histories in its data review, and that some records relate to guarantors, the people who paid someone else's medical bill.

1. Read your explanation of benefits statements. Your insurer sends an EOB (often online) each time a claim is processed. Look for visits, tests or prescriptions you did not get. If you find one, call your insurer and the provider listed. Our guide to medical identity theft covers the full process, including getting your records corrected.
2. Consider the free monitoring. The company's notice says anyone who believes they were affected can enroll in two years of credit monitoring and identity restoration from IDX by calling 1-866-262-5342. Credit monitoring alerts you after the fact; it is not a substitute for a freeze.
3. If your SSN, ID or payment details may be involved, freeze your credit at Equifax, Experian and TransUnion. It is free. See how to freeze your credit.
4. Replace a payment card if you paid a medical bill by card in the period and see anything odd, and turn on transaction alerts with your bank.
5. Ignore unsolicited contact about the breach. The company directs people to changecybersupport.com and its call center. Type the address yourself.

Under HIPAA, the health plan or provider is ultimately responsible for notifying patients, but it can delegate the job to its vendor. HHS's FAQ notes that affected organizations could have Change Healthcare send the notices on their behalf. So a letter may arrive from Change Healthcare, from your insurer, or not at all if your address was out of date. Not getting a letter does not prove you were unaffected; reviewing your EOBs works either way. For other kinds of breach letters, see our data breach triage guide.