Change Healthcare Data Breach: What to Know for Your Social Security Number and More
Notifications have started going out about the Change Healthcare data breach that happened in February.
![outside of unitedhealthcare building in Phoenix, Arizona](https://cdn.mos.cms.futurecdn.net/BUuzxtLqt5YTyCBcZ8RQNE-415-80.jpg)
It's been a scary year for protecting your personal information. A breach at AT&T announced this summer impacted nearly all customers — not to be confused with another AT&T data breach disclosed this spring. There was a breach at Roku and a settlement for Cash App customers after data breaches. And this month, a massive cyberattack at National Public Data was confirmed.
With all this, it's hard to keep track of where your data is at risk, making me feel a bit like a cartoon character figuring out which hole to plug next. Amidst all of that, there was also a data breach at Change Healthcare, which is owned by UnitedHealth. This impacted a massive amount of people; an exact number hasn't been indicated, but Change Healthcare says "the impacted data could cover a substantial proportion of people in America," and the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) noted the cyberattack's "unprecedented magnitude."
While the Change Healthcare data breach happened in February, people are getting letters about it now. Here's what you need to know about this breach.
![https://cdn.mos.cms.futurecdn.net/hwgJ7osrMtUWhk5koeVme7-200-80.png](https://cdn.mos.cms.futurecdn.net/hwgJ7osrMtUWhk5koeVme7-320-80.png)
Sign up for Kiplinger’s Free E-Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
What was the Change Healthcare data breach?
While you may never have heard of Change Healthcare before, there's a high chance you've encountered it. Change Healthcare is a health payment processing company that works on billing and insurance for many health systems including hospitals, medical offices and pharmacies.
In February, hackers breached Change Healthcare. TechCrunch reported at the time it was linked to a Russian-based ransomware group, where hackers demand a ransom. On Feb. 21, Change Healthcare said, the health company began taking steps to stop the hack.
"A substantial quantity of data" was taken from Change Healthcare, the company said.
You may remember that around this time, from February and into the spring, there were major disruptions in healthcare. That included problems with insurance approvals, including payments systems and Medicare reimbursements. Those disruptions were because the company was shutting down certain accesses to try to stop the attack.
The cyberattack and its disruptions led to plenty of questions and investigations about how this happened, including questions from congressmembers and an investigation from the HHS.
During a hearing before the Senate Committee on Finance, UnitedHealth Group CEO Andrew Witty said the company paid a $22 million ransom to the hackers in response to the attack.
What data was part of the Change Healthcare breach?
Data collected in this cyberattack was widespread. It included, per Change Healthcare:
- Names and dates of birth
- Addresses, phone numbers and email addresses
- Health insurance member and group ID numbers, and Medicare payor ID numbers
- Health information, including medical record numbers, diagnoses, test results, medicines and treatment
- Billing and claim information, including billing codes and claim numbers, as well as balance due
- Payment information, including financial and banking information and payment cards
- Social Security numbers
- Driver's licenses, state ID numbers and passport numbers
The company said "the information that may have been involved was not the same for every impacted individual," and it "cannot confirm exactly what data has been affected for each impacted individual."
Change Healthcare also said it has "not yet seen full medical histories or doctors’ charts appear in the data review," and that some information may have been related to guarantors who paid for healthcare services, not patients themselves.
How to know if you were part of the Change Healthcare data breach
As mentioned, Change Healthcare has started to send out letters to people whose data was impacted by this cyberattack. The company said it began sending written letters, via mail, on July 29 and is continuing to send out notices as it identifies people.
However, the company also notes that it may not have proper mailing addresses for all impacted individuals, so even if you didn't receive a letter, there's a chance you were part of the data breach.
What to do to protect your data
Because of the widespread impact of this data breach, Change Healthcare is offering free credit monitoring and identity theft protections for two years to "anyone who believes they may have been impacted." To access this, you can scroll down to the words "What can you do now?" on this page and click "Enroll now." You can also call 1-888-846-4705 to enroll yourself.
Change Healthcare also has a dedicated call center available both to access those services and to access emotional support services. You can reach that call center at 1-866-262-5342.
There are several things to do right away if you're a victim of a data breach, many of which Change Healthcare also recommends. That includes monitoring your credit reports and financial accounts, looking for anything that looks unusual. You can also freeze your credit accounts to protect your credit. Change Healthcare additionally recommends monitoring your healthcare explanation of benefits statements for anything that looks off.
Kiplinger also recommends you change your password on key accounts, including changing your Social Security login. You can use password managers like 1Password to store your passwords and create extra-secure ones.
For an additional measure of safety, set up multifactor authentication for key accounts, which means, for example, to log into a bank account, you need to enter a password and a code texted to your phone number. In fact, Witty of UnitedHealth told the Senate the hackers were able to get into a server because it didn't have multifactor authentication, so you can understand how useful a safety measure that is.
Related content
Get Kiplinger Today newsletter — free
Profit and prosper with the best of Kiplinger's advice on investing, taxes, retirement, personal finance and much more. Delivered daily. Enter your email in the box and click Sign Me Up.
Alexandra Svokos is the senior digital editor of Kiplinger. She holds an MBA from NYU Stern in finance and management and a BA in economics and creative writing from Columbia University. Alexandra has a decade of experience in journalism and previously served as the senior editor of digital for ABC News, where she directed daily news coverage across topics through major events of the early 2020s for the network's website, including stock market trends, the remote and return-to-work revolutions, and the national economy. Before that, she pioneered politics and election coverage for Elite Daily and went on to serve as the senior news editor for that group.
Alexandra was recognized with an "Up & Comer" award at the 2018 Folio: Top Women in Media awards, and she was asked twice by the Nieman Journalism Lab to contribute to their annual journalism predictions feature. She has also been asked to speak on panels and give presentations on the future of media and on business and media, including by the Center for Communication and Twipe.
-
Three out of Four Retirees Say They’re OK Financially: Will You Be One of Them?
In a snapshot survey of views on retirement in the U.S., three in four retirees say they have enough money to live comfortably. Will you be able to say the same?
By Charlotte Gorbold Published
-
10 Bond Investments to Consider Before the Fed Cuts Rates
Why these picks for your bond portfolio are poised to help you get the biggest return in market conditions.
By Nellie S. Huang Published
-
Five December 31 Tax Deadlines for Retirees
The end of the year will be here before you know it, so it might be a good idea to start thinking soon about what you need to do for taxes before it arrives.
By Evan T. Beach, CFP®, AWMA® Published
-
For Lawyers, the Bar Exam Is More Than Just a Test
People who pass it within a few tries are proving they understand legal ethics and can handle pressure, advocate for consumers and communicate in writing.
By H. Dennis Beaver, Esq. Published
-
How AI Can Guide Introverts to Success in Professional Services
Fear of rejection and awkward conversations can keep accounting and law firms from realizing significant growth. AI can help with that.
By Timothy Keith Published
-
Why You Should Expect a Lower Social Security COLA for 2025
Avoid the COLA social security dip in 2025 with a Health Savings Account
By Sandra Block Published
-
In Family Philanthropy, Embracing Differences Can Pay Off
Different approaches to charitable giving among generations and individuals can actually enhance the family's giving. Here's how.
By Julia Chu Published
-
Apple's Launch Event 2024: Next-Generation Apple Watches and New AirPods 4
Apple’s September 9th big event is sure to surprise and amaze with the new iPhone 16, along with next-generation Apple Watch models and new AirPods 4.
By Kathryn Pomroy Last updated
-
Five Things About Annuities That May Surprise You
They're more varied, flexible and cost-effective than most people think, so don't let their complexity scare you off.
By Ken Nuss Published
-
This "Super" 529 Strategy Can Help You Jumpstart College Savings
This 529 strategy — superfunding a 529 — can help you maximize savings for a child or grandchild's education expenses.
By Erin Bendig Published