01—Abstract
Summary
Summary of the 8-K/A filed April 24, 2024. Cited figures are marked; the original filing is the authoritative source.
UnitedHealth Group filed Amendment No. 2 to its February 2024 Form 8-K, updating its Item 1.05 cybersecurity disclosure on the Change Healthcare cyberattack via a press release dated April 22, 2024 (Exhibit 99.1).
The company said its preliminary, targeted data sampling has found files containing protected health information (PHI) or personally identifiable information (PII) that could cover a substantial proportion of people in America. It also stated it has not yet seen evidence of exfiltration of materials such as doctors' charts or full medical histories. Formal identification and notification of impacted individuals is expected to take several months, and the company is offering two years of free credit monitoring and identity theft protection through a call center that includes clinicians.
Operationally, service restoration is well advanced. Pharmacy claims processing is back to near-normal levels, with 99%a of pre-incident pharmacies able to process claims. Medical claims are flowing at near-normal levels, though a small number of providers remain adversely affected and are receiving alternative submission solutions and financial support.
Change Healthcare payment processing, which handles about 6%b of U.S. health care payments, was at roughly 86% of pre-incident levels, and approximately 80% of Change functionality has been restored on major platforms, with full restoration of other systems expected within weeks. For investors, the filing is primarily a disclosure update rather than a financial report: it contains no quantified financial impact, reserves, or guidance.
The principal open risks are the scale of the data breach, the timing and cost of notifications and remediation, potential regulatory, legal, and litigation exposure, and whether restoration of remaining services is completed as projected. The company has also offered to handle notification obligations on behalf of providers and customers, which may increase its near-term administrative and financial burden.
02—Key points
Key Highlights
- Amendment No. 2 updates the Item 1.05 Material Cybersecurity Incident disclosure for the Change Healthcare cyberattack, filed via an April 22, 2024 press release (Exhibit 99.1).
- Preliminary targeted data sampling found files containing PHI or PII that could cover a substantial proportion of people in America; no evidence yet of exfiltration of doctors' charts or full medical histories.
- Formal data review is expected to take several months before impacted individuals can be identified and notified; this is explicitly not an official breach notification.
- UnitedHealth is offering two years of free credit monitoring and identity theft protection, plus clinician support, via a dedicated call center.
- Pharmacy claims are back to near-normal levels (99% of pre-incident pharmacies processing claims); medical claims are flowing near normal, with a small number of providers still adversely affected.
- Change Healthcare payment processing (about 6% of U.S. health care payments) was at roughly 86% of pre-incident levels, and about 80% of Change functionality has been restored on major platforms.
- The company has offered to make notifications and handle related administrative requirements on behalf of providers and customers, and the filing contains no quantified financial impact.
03—Questions
Frequently Asked Questions
Has UnitedHealth confirmed that patient data was stolen in the Change Healthcare attack?
Not definitively. The company reported that targeted sampling found files containing PHI or PII, and that 22 allegedly exfiltrated screenshots were posted on the dark web for about a week. It has not seen evidence of exfiltration of materials such as doctors' charts or full medical histories, and it states this is not an official breach notification pending completion of the data review.
How many people could be affected?
The company said the data involved could cover a substantial proportion of people in America, but it has not yet quantified the number of impacted individuals. The call center cannot provide specifics on individual data impact at this time, and identification will take several months.
What support is UnitedHealth offering to individuals?
It is offering two years of free credit monitoring and identity theft protection to anyone impacted, along with support services from trained clinicians through a dedicated call center at 1-866-262-5342 and a dedicated website.
Is the Change Healthcare system back to normal, and what is the financial impact?
Operations are largely restored: pharmacy claims are near normal, medical claims are flowing near normal, payment processing is at about 86% of pre-incident levels, and about 80% of functionality is restored, with the rest expected within weeks. The filing does not quantify the financial impact, reserves, or guidance changes, so investors should refer to the company's periodic reports for those figures.
04—Continue