Nebraska Attorney General Mike Hilgers filed a lawsuit against Change Healthcare, a subsidiary of UnitedHealth Group, alleging the company violated state consumer protection and data security laws after a February ransomware attack.
The lawsuit, filed in Lancaster County District Court, accuses Change Healthcare of inadequate security measures that allowed hackers to infiltrate its systems, steal sensitive data, and deploy ransomware. Mr. Hilgers said the breach left Nebraska healthcare providers unable to process payments, delaying critical medical services.
The attorney general's office also claims Change Healthcare delayed notifying affected individuals for nearly five months, leaving Nebraskans vulnerable to identity theft and financial fraud.
"A functioning medical marketplace needs to have a trustworthy medical payments backbone. It requires companies who do what they say they will do, and do everything possible to protect Nebraska's health information and who provide proper notice to Nebraskans when their data is breached," Mr. Hilgers said in a Dec. 16 news release. "This suit is intended to help restore trust in our system and remedy the harm suffered by Nebraskans and their medical providers."
Mr. Hilgers urged Nebraska healthcare providers affected by the breach to share their experiences through the Nebraska Attorney General's Office website.
The lawsuit also includes UnitedHealth Group and Optum.
The Feb. 21 ransomware attack on Change Healthcare affected 100 million individuals. UnitedHealth has said it believes the hacking group ALPHV, also known as BlackCat, was responsible for the incident.