“Approximately 100 million individual notifications were sent regarding this breach,” says the US Department of Health and Human Services.

UnitedHealth Group revealed that data belonging to approximately 100 million people was affected in a widely felt way. infringe of Change Healthcare earlier this year.

The insurer had already declared in June he believes patients’ sensitive medical data was exposed in the February attack. And during testimony before the U.S. House of Representatives on May 1, UnitedHealth Group CEO Andrew Witty said that “perhaps a third” of all Americans were affected by the attack.

(Related: 10 Major Cyberattacks and Data Breaches in 2024 (So Far))

In an online update On Thursday, the Office for Civil Rights (OCR) of the US Department of Health and Human Services updated the number of people affected.

“On October 22, 2024, Change Healthcare informed OCR that approximately 100 million individual notifications were sent regarding this breach,” the updated website states.

A Reuters report reported that this makes the Change Healthcare attack the largest healthcare breach in the United States to date.

Medical data stolen in the attack could include “diagnostics, medications, test results, images, care and treatment,” according to the data breach notification released by Change Healthcare in June.

First revealed on February 22, the Change Healthcare attack caused massive disruption to the US healthcare system for weeks. The IT system shutdown initiated in response to the ransomware attack prevented many pharmacies and hospitals, as well as other health care facilities and offices, from processing claims and receiving payments.

The Russian-speaking cybercriminal group known as Blackcat and Alphv claimed responsibility for the ransomware attack. Witty confirmed during his congressional testimony in May that UnitedHealth paid a $22 million ransom following the attack.

Subsequently, another cybercriminal gang, known as RansomHub, published data it claimed had been stolen from Change Healthcare.

UnitedHealth said in late April that data belonging to a “substantial proportion” of Americans may have been stolen in the attack on prescription processor Change Healthcare, a unit of the insurer’s Optum subsidiary.