Change Healthcare says data stolen by hackers in a February cyberattack likely covers a "substantial proportion of people in America."
The UnitedHealth Group claims processing subsidiary said April 22 an initial sampling of the breached data shows it comprises protected health information and personally identifiable information from a large swath of the country. Change processes about 15 billion healthcare transactions annually, handling 1 in 3 patient records.
"We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it," UnitedHealthGroup CEO Andrew Witty said in a statement.
The company set up a website and hotline for more information on the data breach and is offering two years of free credit monitoring and identity theft protection for anyone affected. Change said it can't offer specifics on individual-level data taken by hackers at this time, but will notify people once the investigation concludes.
Change Healthcare said it has no evidence that any physicians' charts or full medical histories were pilfered in the ransomware attack. The company, part of UnitedHealth Group's Optum, also acknowledged that cybercriminals recently posted 22 screenshots of health and personal data allegedly stolen in the hack for about a week on the dark web.