In February 2024, a cyberattack against Change Healthcare exposed the protected health information of approximately 100 million individuals, according to the supplied source. The incident illustrates the concentrated privacy risk created when a major healthcare technology intermediary stores and processes data at enormous scale: a single intrusion can compromise medical information belonging to a substantial share of the population. The source does not identify the attackers, a responsible executive, or the specific vulnerability that enabled the intrusion, so those details remain outside the verified record here.
The breach also exposed weaknesses in the broader healthcare sector’s security model, where organizations must protect sensitive records while relying on interconnected vendors and business associates. Under the U.S. HIPAA Breach Notification Rule, covered entities and business associates generally must notify affected individuals within 60 days of discovering a breach of unsecured protected health information; incidents affecting at least 500 people must also be reported to federal regulators and prominent media. The Change Healthcare attack prompted increased scrutiny of cybersecurity practices across healthcare, while leaving victims facing long-term risks including identity theft, fraud, and the circulation of personal information on criminal marketplaces.
