Minneapolis, Minnesota – UnitedHealth Group announced on Monday that its health tech subsidiary, Change Healthcare, fell victim to a ransomware attack earlier this year. The cyberattack resulted in a significant theft of Americans’ private healthcare data, raising concerns about the security of sensitive medical information.

According to a statement released by UnitedHealth, a ransomware gang successfully accessed files containing personal data and protected health information, potentially impacting a substantial number of individuals across the country. However, the company did not disclose the exact number of Americans affected by the breach.

Change Healthcare plays a critical role in processing insurance and billing for numerous hospitals, pharmacies, and medical practices nationwide. With access to vast amounts of health information on approximately half of all Americans, the cybersecurity breach has raised alarms about the protection of confidential medical records.

While UnitedHealth has not found evidence of complete medical histories or doctors’ charts being compromised, the incident highlights the vulnerabilities within the healthcare system to sophisticated cyber threats. The disclosure of the data breach comes on the heels of a hacking group known as RansomHub publishing portions of the stolen data in an attempt to extort a second ransom from Change Healthcare.

RansomHub, the second group to demand a ransom from the health tech giant, threatened to sell the stolen data unless their demands were met. The incident sheds light on the increasing risks faced by companies in the healthcare sector, as cybercriminals target valuable patient information for financial gain.

The ransomware attack, which began on February 21, led to widespread outages at pharmacies and hospitals across the United States, disrupting crucial healthcare operations. As physicians, pharmacies, and hospitals struggled to verify patient benefits and process necessary authorizations, the healthcare system faced significant challenges, impacting patient care and financial stability.

The fallout from the cyberattack has cost UnitedHealth more than $870 million in losses, underscoring the financial implications of such security breaches in the healthcare industry. The company’s CEO, Andrew Witty, is scheduled to testify before House lawmakers on May 1, highlighting the urgency of addressing cybersecurity threats in the healthcare sector and safeguarding patients’ sensitive data.