The February 2024 ransomware attack on Change Healthcare, UnitedHealth Group's claims-processing arm, exposed data on roughly 190 million people — the largest healthcare breach ever reported in the U.S. Despite what some websites imply, there is no settlement and no claim form yet. Here is where the consolidated lawsuit actually stands, and what affected people should do in the meantime.
Allegations Only · No Settlement Yet
This article describes consolidated class action complaints. The statements below are unproven allegations. Change Healthcare and UnitedHealth Group have not been found liable, no class has been certified, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
In February 2024, a ransomware attack forced Change Healthcare — a UnitedHealth Group subsidiary that processes medical claims, billing, and payments for a huge share of the U.S. healthcare system — to take its systems offline, disrupting pharmacies and providers nationwide for weeks. The company later confirmed that data was stolen, and its regulator filing ultimately put the number of affected people at approximately 192.7 million, up from the roughly 100 million first reported. Because Change Healthcare sits in the middle of the healthcare system rather than facing patients directly, most affected people never chose to do business with it — their data flowed through it via their insurer, pharmacy, or provider.Hundreds of lawsuits followed, and the federal cases were consolidated as In re Change Healthcare, Inc. Customer Data Security Breach Litigation, MDL No. 3108, before Judge Donovan W. Frank in the U.S. District Court for the District of Minnesota. The consolidated complaints allege that Change Healthcare failed to implement reasonable security measures — including multifactor authentication on the compromised server — and that victims face a lifetime of identity-theft risk. Those are allegations; the defendants have not been found liable, and the litigation is contested.
Where the Case Stands in 2026
The MDL is in active pretrial proceedings. The court has been holding regular status conferences — including an informal status conference with lead counsel on June 18, 2026 — and reporting on the litigation indicates that class certification rulings and possible settlement discussions are the expected next phases. A federal judge has also been reviewing the status of settlement-related negotiations, but no agreement has been announced, and legal observers expect serious settlement talks in late 2026 or 2027 at the earliest.Separately, state enforcement is moving on its own track: Nebraska's attorney general sued Change Healthcare over the breach, and that lawsuit survived a motion to dismiss. Regulators including the HHS Office for Civil Rights have their own inquiries into the incident.
The realistic timeline matters for expectations. Even if a settlement were announced tomorrow, it would still need preliminary approval, a notice program reaching nearly 200 million people, a claim window, and final approval before any payment — a process that takes a year or more on its own. Data breach settlements of this scale have historically taken years; Equifax's breach happened in 2017 and its settlement claims opened in 2019.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Is Affected?
Roughly six in ten Americans, by the company's own numbers. According to Change Healthcare's breach notices, the exposed data varies by person and may include names, addresses, dates of birth, Social Security numbers, driver's license numbers, health insurance details, medical information including diagnoses and treatments, and billing, claims, and payment information — including financial account details for some people.You did not need to be a Change Healthcare customer, because consumers never are directly. If your insurer, pharmacy, or medical provider routed claims through Change Healthcare's network — and most do — your data could have been in its systems. The company mailed notice letters on a rolling basis starting in mid-2024, but the notices reached far fewer people than the breach total, so not receiving a letter does not mean you were unaffected.
Watch Out for Fake "Settlement" Sites
Because "Change Healthcare settlement" is one of the most-searched class action terms in the country, sites and social posts have appeared implying a claim fund already exists. It does not. There is no settlement, no administrator, and no claim form. Do not enter your Social Security number or banking details into any site claiming to process Change Healthcare settlement claims. When a real settlement exists, the claim site will be named in a court-approved notice, and this page will link to it.What Should You Do Now?
The things worth doing are the ones that protect you today and strengthen any future claim:• Keep records of identity theft, fraudulent accounts, medical billing errors, or out-of-pocket costs you trace to the breach — settlement claim processes pay documented losses first.
• Review your explanation-of-benefits statements for care you never received, which is the signature harm of medical-data theft.
• Consider a free credit freeze with Equifax, Experian, and TransUnion.
• UnitedHealth Group has offered free credit monitoring and identity protection to affected individuals through its support program since 2024.
What Happens Next?
The next milestones to watch are class certification briefing and rulings in the MDL, any court-supervised mediation, and — if the parties reach a deal — a preliminary approval motion that would put real dates on notice and claims. We track this docket and will update this page when any of those land. In the meantime, the court maintains an official public page for the MDL with case information and filings.Sources
• U.S. District Court, District of Minnesota — Change Healthcare, Inc. Data Breach (MDL No. 3108)• HIPAA Journal — Change Healthcare cyberattack coverage and litigation updates
• The HIPAA Guide — Change Healthcare data breach: 192.7 million affected
OpenClassActions.com is a consumer news site and is not a law firm or the court.
Frequently Asked Questions
Is there a Change Healthcare settlement I can file a claim for?
No. As of July 28, 2026, no class action settlement has been reached in the Change Healthcare data breach litigation, no class has been certified, and there is no claim form. The consolidated case is in pretrial proceedings in Minnesota federal court. Any website or message telling you to file a Change Healthcare settlement claim right now is not connected to a real settlement and should be treated with suspicion.
How many people were affected by the Change Healthcare data breach?
Change Healthcare's regulator filing puts the figure at approximately 192.7 million people — updated from the roughly 100 million initially reported — making it the largest healthcare data breach ever reported in the United States. Because Change Healthcare processes claims for a huge share of the U.S. healthcare system, people who never heard of the company before the breach are affected.
What information was exposed in the Change Healthcare breach?
According to Change Healthcare's breach notices, the data varies by person and may include names, addresses, dates of birth, Social Security numbers, driver's license numbers, health insurance information, medical records including diagnoses and treatments, and billing and payment information, including financial account details for some individuals.
What should Change Healthcare breach victims do right now?
Keep records of any identity theft, fraud, or out-of-pocket costs you traced to the breach — those records are what any eventual settlement claim process would ask for. Consider a credit freeze with the three bureaus, monitor your explanation-of-benefits statements for care you never received, and be wary of unsolicited calls or emails referencing the breach.
When could a Change Healthcare settlement happen?
No one can promise a date. The court has been holding regular status conferences, and reporting on the litigation indicates class certification rulings and possible settlement discussions are the expected next phases. Cases of this size often take years; if a settlement is reached, it would still need preliminary approval, a notice program, and a claim period before anyone is paid.
