Change Healthcare Class Action Lawsuit: 2026 Guide

Never Miss a Lawsuit Update

Mark Lawfold as a Preferred Source so you never miss a settlement deadline or new filing.

The Change Healthcare class action lawsuit is one of the largest healthcare data breach cases in U.S. history. Roughly 190 million people had their personal and medical information exposed in a February 2024 cyberattack. Now, heading into 2026, affected patients and providers want to know what they can recover.

This guide breaks down everything you need to know. You’ll find payout estimates, eligibility rules, filing steps, and critical deadlines.

If your data passed through Change Healthcare’s systems, you likely qualify. Some claimants could receive hundreds or even thousands of dollars depending on the harm they suffered.

Here's something related: Startups Lawsuit 2026: Eligibility, Payouts and Deadlines

The MDL is moving fast. Here is where things stand right now and what to expect in the months ahead.

Change Healthcare Class Action Lawsuit Overview

The Change Healthcare class action lawsuit is a federal legal action against Change Healthcare and its parent company, UnitedHealth Group, for failing to protect patient data from a massive cyberattack. The case centers on a February 2024 ransomware attack carried out by the ALPHV/BlackCat hacking group.

Change Healthcare processes about 15 billion healthcare transactions per year. That makes it a backbone of the U.S. healthcare billing system. When hackers broke in, they accessed an enormous volume of sensitive records.

The stolen data included names, Social Security numbers, medical diagnoses, insurance details, billing records, and prescription histories. For millions of Americans, this wasn’t just a data breach. It was a complete exposure of their most private health information.

Plaintiffs allege negligence, violations of HIPAA standards, breach of fiduciary duty, and failure to implement basic cybersecurity protections. UnitedHealth Group CEO Andrew Witty confirmed in Congressional testimony that the breach occurred because a critical server lacked multi-factor authentication.

That single security failure opened the door to the largest healthcare data theft ever recorded.

Change Healthcare Class Action Lawsuit Payout

The Change Healthcare class action lawsuit payout will vary based on each claimant’s documented losses and the type of harm suffered. No final settlement amount has been approved by the court as of early 2026, but legal analysts project a total settlement fund in the billions of dollars.

Individual payouts will likely fall into tiers. People with documented identity theft or financial fraud will receive the most. Those with only data exposure and no proven harm will receive smaller payments, possibly through automatic credit monitoring or flat-rate cash payments.

Here is what legal experts are projecting for payout tiers:

These figures are estimates based on similar data breach settlements like the Equifax settlement ($125 to $20,000 per person) and the Anthem data breach settlement ($50 to $10,000). The final numbers depend on the total settlement fund size and how many people file valid claims.

Keep in mind: the more people who file, the smaller each payment gets. That is how class action math works. Filing early with strong documentation gives you the best shot at a higher payout.

Change Healthcare Lawsuit Settlement

The Change Healthcare lawsuit settlement is still being negotiated as of 2026. No final agreement has been announced, but multiple rounds of mediation between plaintiffs’ attorneys and UnitedHealth Group’s legal team have taken place.

Settlement talks have accelerated in recent months. Legal observers believe UnitedHealth Group wants to resolve this before bellwether trials begin, which could expose damaging internal documents to the public. Settling early limits that risk.

UnitedHealth Group reported $32.4 billion in revenue for Q4 2024 alone. The company has the financial capacity to fund a multi-billion-dollar settlement. Plaintiffs’ attorneys have pointed to this in court filings, arguing the company can afford meaningful compensation.

• Settlement negotiations are active and ongoing
• Bellwether trial dates have been discussed for late 2026
• Mediation sessions have occurred in federal court
• UnitedHealth Group has already spent over $2 billion on breach response costs
• A global settlement could include cash payments, credit monitoring, and insurance coverage

If a settlement is reached in 2026, the court will schedule a fairness hearing. Class members will then have a chance to object or opt out. After approval, payments typically begin 6 to 12 months after the final order.

Key Takeaway: The Change Healthcare class action lawsuit is tracking toward a potential multi-billion-dollar settlement in 2026, with individual payouts ranging from $50 for basic exposure to $25,000 or more for severe identity theft victims.

Change Healthcare Data Breach Settlement Amount

The Change Healthcare data breach settlement amount has not been finalized, but the total fund is expected to reach between $3 billion and $10 billion based on the scale of the breach and comparable precedents. This would make it the largest healthcare data breach settlement in history.

For context, here is how it compares to past data breach settlements:

The Change Healthcare breach dwarfs every previous case in both the number of victims and the sensitivity of the data stolen. Medical records, prescription histories, and treatment details carry far more weight in court than email addresses or passwords.

Plaintiffs’ lead counsel has argued that the per-person value should reflect the uniquely sensitive nature of health data. Unlike a credit card number, you can’t change your medical history. Once it is exposed, the damage is permanent.

UnitedHealth Group’s own SEC filings acknowledge over $2.5 billion in direct costs from the breach, including ransom payments, system restoration, and provider advance payments. Any settlement would be on top of those costs.

Change Healthcare Settlement Payout Per Person

The Change Healthcare settlement payout per person will depend on three factors: the total fund size, the number of valid claims filed, and the individual’s documented harm. Estimated per-person payouts range from $50 to $25,000 or more.

Think of it like an insurance claim. The more proof you bring, the bigger your check. Someone who can show fraudulent charges on their accounts, hours spent fixing credit issues, or medical identity theft will receive far more than someone who simply received a breach notification letter.

Here is a breakdown of what affects your individual payout:

• Documentation strength: Receipts, bank statements, credit reports showing fraud
• Type of data exposed: SSN exposure pays more than address exposure
• Out-of-pocket costs: Money spent on credit monitoring, legal fees, or replacing documents
• Time spent: Hours logged dealing with the breach aftermath
• Emotional distress: Documented anxiety, stress, or medical treatment related to the breach

Quick Facts:

• Minimum expected payout: $50 (basic data exposure)
• Average expected payout: $200 to $1,000
• Maximum expected payout: $25,000+ (severe identity theft with documentation)

Claimants who opt out of the class action to file individual lawsuits could potentially recover even more, but that path is riskier and more expensive.

Who Qualifies for the Change Healthcare Lawsuit

Anyone whose personal, medical, or financial data was processed through Change Healthcare’s systems and was compromised in the February 2024 breach qualifies for this lawsuit. That includes patients, policyholders, and even people who never directly interacted with Change Healthcare.

This is what catches most people off guard. You don’t need to have heard of Change Healthcare before. The company operates behind the scenes, processing claims between your doctor, your pharmacy, and your insurance company. If you used health insurance in the United States at any point before February 2024, your data may have flowed through their systems.

Here is who qualifies:

• Patients whose medical records were stored or processed by Change Healthcare
• People who received a data breach notification letter from Change Healthcare or UnitedHealth Group
• Individuals whose insurance claims were routed through Optum or Change Healthcare
• Anyone whose Social Security number, medical records, or billing data was exposed
• People who have experienced identity theft or fraud since the breach

If you’re unsure, check whether you received a notification letter. Change Healthcare mailed notices to affected individuals starting in mid-2024. You can also check with your insurance provider directly.

Key Takeaway: You don’t need to have directly used Change Healthcare’s services to qualify. If your health data was processed through their network at any point, you are likely an eligible class member.

Change Healthcare Class Action Lawsuit Eligibility

Change Healthcare class action lawsuit eligibility is broad because the breach affected virtually every segment of the U.S. healthcare system. To be eligible, you must have had protected health information, personally identifiable information, or financial data compromised in the breach.

The eligibility criteria break down into two main categories: patients and providers. Each has different requirements and potential compensation paths.

Patient Eligibility Checklist:

• Your health insurance provider used Change Healthcare for claims processing
• You received a breach notification from Change Healthcare, Optum, or UnitedHealth Group
• Your Social Security number, date of birth, or medical records were in Change Healthcare’s system
• You have evidence of identity theft, fraud, or credit damage since February 2024

Provider Eligibility Checklist:

• Your practice, hospital, or pharmacy submitted claims through Change Healthcare
• You suffered financial losses from the billing system outage
• Patient data you submitted was compromised
• You incurred costs switching to alternative claims processors

One key detail: you do not need to prove actual harm to be eligible for the class action. Data exposure alone is sufficient for membership in the class. However, proving actual harm significantly increases your potential payout.

Minors whose data was exposed are also eligible. Parents or legal guardians can file claims on their behalf.

How to File a Change Healthcare Class Action Claim

Filing a Change Healthcare class action claim involves submitting a proof of claim form through the official settlement website once the court approves a settlement agreement. As of early 2026, the claims process has not yet formally opened because the settlement is still being finalized.

Here is what you can do right now to prepare:

Step 1: Gather Documentation
Collect any breach notification letters, medical bills, insurance statements, credit monitoring alerts, or bank statements showing fraud.

Step 2: Monitor the MDL Docket
The case is consolidated under MDL No. 3108 in the U.S. District Court for the District of Minnesota. Court updates are posted publicly on the federal court’s PACER system.

Step 3: Register with Class Counsel
Several plaintiffs’ law firms are managing the case. You can register your information with them to receive updates when the claims portal opens.

Step 4: File Your Claim
Once the settlement website launches, submit your claim form with supporting documents.

If you're curious, also see Lebanon CT Budget Shortfall Lawsuit 2026: What You Need

The most important thing you can do right now is save every piece of paper related to the breach. Bank alerts, credit report changes, medical billing errors, and time logs all count as evidence.

Change Healthcare Lawsuit Deadline

The Change Healthcare lawsuit deadline for filing claims has not been set because the settlement has not received final court approval. However, legal experts expect the claims window to open in mid to late 2026 with a filing period of 90 to 180 days.

Missing the deadline means forfeiting your right to compensation. It is that simple. In every class action, a percentage of eligible people never file because they miss the window or forget. Don’t be one of them.

Here is the projected timeline:

For the separate statute of limitations on individual lawsuits, most states give you 2 to 4 years from the date you discovered the breach. Since notifications went out in 2024, that clock is already running.

If you want to preserve your legal options, act in 2026. Waiting until 2027 could mean your individual lawsuit rights expire in some states.

Key Takeaway: No official claims deadline exists yet, but the window is expected to open in 2026 with a 90 to 180 day filing period. Start gathering documentation now so you are ready to file the moment the portal opens.

Change Healthcare Lawsuit Update 2026

The Change Healthcare lawsuit update for 2026 shows the case is entering its most active phase. MDL proceedings are advancing, discovery is underway, and settlement discussions have intensified.

As of early 2026, here are the major developments:

• MDL consolidation is complete under Judge Donovan W. Frank in Minnesota
• Over 100 individual lawsuits have been consolidated into the MDL
• Discovery motions have been filed, requiring UnitedHealth Group to produce internal security audit documents
• Bellwether case selection is underway, with initial trial dates discussed for late 2026
• Mediation between lead plaintiffs’ counsel and defense attorneys has occurred in multiple sessions
• UnitedHealth Group has not admitted liability but has indicated willingness to negotiate

The discovery phase has produced damaging revelations. Internal documents reportedly show that Change Healthcare’s cybersecurity team flagged vulnerabilities months before the breach. Management allegedly delayed implementing recommended fixes due to cost concerns.

Congressional scrutiny continues as well. Multiple Senate committees have held hearings on healthcare cybersecurity in the wake of this breach. Proposed legislation could impose stricter penalties on healthcare companies that fail to protect patient data.

For claimants, the 2026 trajectory is encouraging. The combination of strong evidence, massive victim count, and intense public pressure creates conditions favorable for a substantial settlement.

Change Healthcare Data Breach Lawsuit

The Change Healthcare data breach lawsuit specifically targets the company’s failure to safeguard protected health information under federal and state privacy laws. This is the factual heart of the entire legal action.

On February 21, 2024, hackers from the ALPHV/BlackCat ransomware group penetrated Change Healthcare’s network. They moved through the system for approximately nine days before deploying ransomware. During that time, they exfiltrated roughly 6 terabytes of data.

The breach wasn’t just about stolen data. It shut down healthcare billing across the country for weeks. Pharmacies couldn’t process prescriptions. Hospitals couldn’t submit insurance claims. Small medical practices nearly went bankrupt waiting for payment.

Key facts about the breach:

• Attack vector: Stolen credentials used on a server without multi-factor authentication
• Dwell time: Approximately 9 days before detection
• Data stolen: 6 terabytes of health records, financial data, and personal information
• Ransom paid: UnitedHealth Group reportedly paid $22 million in ransom
• System downtime: Weeks of billing disruptions across U.S. healthcare
• Total affected: Approximately 190 million individuals

The lawsuit alleges that Change Healthcare had a duty to protect this information and failed on multiple levels. From inadequate encryption to missing authentication protocols, the security gaps were systemic rather than isolated.

Change Healthcare Cyberattack Lawsuit

The Change Healthcare cyberattack lawsuit focuses on how the attack happened, who is responsible, and what security standards were violated. This legal theory goes beyond simple data breach claims to allege willful negligence and recklessness.

The ALPHV/BlackCat group is a well-known ransomware operation. Federal agencies had issued warnings about this group for months before the attack. Plaintiffs argue that Change Healthcare ignored these warnings and failed to take basic protective steps.

Here is what the lawsuit specifically alleges:

• Change Healthcare did not require multi-factor authentication on critical systems
• The company failed to segment its network, allowing hackers to move freely once inside
• Intrusion detection systems either were not in place or failed to trigger alerts
• Employee credentials were not rotated or monitored for compromise
• The company prioritized profits over cybersecurity investments

UnitedHealth Group CEO Andrew Witty told Congress he took “full responsibility” for the breach. That statement has become a key piece of evidence in the litigation.

Key Takeaway: The Change Healthcare cyberattack succeeded because of basic, preventable security failures that the company’s own team had flagged before the breach occurred.

Change Healthcare MDL Lawsuit

The Change Healthcare MDL (multidistrict litigation) lawsuit is the centralized federal proceeding where hundreds of individual and class action cases have been consolidated for pretrial proceedings. The MDL is assigned as Case No. 3108 in the U.S. District Court for the District of Minnesota.

MDL is not the same as a class action, and understanding the difference matters for your claim.

In the Change Healthcare MDL, Judge Donovan W. Frank is overseeing pretrial motions, discovery, and settlement negotiations. A steering committee of plaintiffs’ attorneys has been appointed to manage the litigation on behalf of all plaintiffs.

Bellwether trials are a critical step. The court selects a handful of representative cases to go to trial first. The outcomes of those trials set the tone for settlement negotiations. If plaintiffs win big in bellwether trials, the defendant faces pressure to settle the rest of the cases for substantial amounts.

The MDL structure allows the court to handle the massive volume of claims efficiently without clogging individual court dockets across the country.

Change Healthcare Data Breach Compensation

Change Healthcare data breach compensation will come in several forms, not just cash payments. The settlement is expected to include monetary payments, free services, and reimbursement for out-of-pocket costs.

Here is what compensation could look like:

Direct Cash Payments

• Flat-rate payments for all class members (estimated $50 to $150)
• Tiered payments based on documented harm ($150 to $25,000+)

Credit Monitoring and Identity Protection

• Free credit monitoring for 3 to 5 years through all three major bureaus
• Identity theft insurance coverage (typically $1 million in coverage)
• Dark web monitoring for exposed information

Out-of-Pocket Reimbursement

• Money you spent on credit freezes or monitoring services
• Costs for replacing government documents (passport, driver’s license)
• Bank fees related to fraud
• Professional fees (accountants, attorneys, identity restoration services)

Time Compensation

• Payment for documented hours spent dealing with breach aftermath
• Typical rate: $25 to $30 per hour, capped at a set number of hours

The best way to maximize your compensation is to document everything. Save every receipt, screenshot every alert, and log every hour you spend dealing with the breach.

Change Healthcare Lawsuit for Providers

The Change Healthcare lawsuit for providers addresses a separate category of damages that healthcare practices, hospitals, pharmacies, and billing companies suffered when the breach took down Change Healthcare’s systems for weeks.

Providers were hit with a double punch. First, their patients’ data was stolen. Second, the system outage meant they couldn’t process claims or receive insurance payments. For small medical practices, this created a genuine financial crisis.

Here is what providers can claim:

• Lost revenue from weeks of inability to process insurance claims
• Operational costs from switching to alternative claims processors
• Staff overtime to manage the billing backlog
• Cash flow damage from delayed reimbursements
• Patient notification costs for HIPAA compliance
• Reputational harm from patients losing trust

UnitedHealth Group offered advance payments to some providers during the outage, but many practices reported that the amounts were insufficient and came with repayment strings attached.

Provider claims are being handled both within the MDL and through separate commercial litigation. The legal strategies differ from patient claims because providers can demonstrate concrete, quantifiable financial losses rather than relying on data exposure theories.

Key Takeaway: Healthcare providers have separate, often larger claims than individual patients because they can point to specific dollar amounts in lost revenue, operational costs, and billing disruptions caused by the system outage.

Change Healthcare Identity Theft Lawsuit

The Change Healthcare identity theft lawsuit represents the most serious category of claims in this litigation. Individuals who experienced actual identity theft, medical identity theft, or financial fraud as a result of the breach have the strongest cases and the highest potential payouts.

Medical identity theft is particularly dangerous. When someone uses your stolen health records to obtain medical care, their information gets mixed into your medical file. This can lead to wrong prescriptions, incorrect diagnoses on your record, or insurance denials based on treatments you never received.

Here is what identity theft claimants are reporting:

• Fraudulent medical claims billed to their insurance
• Unauthorized credit accounts opened using their Social Security numbers
• Tax return fraud using stolen personal information
• Phishing attempts using specific details from their medical records
• Prescriptions filled in their name at pharmacies they have never visited

If you have experienced identity theft, take these steps immediately:

• File a report with the Federal Trade Commission at IdentityTheft.gov
• Place fraud alerts and credit freezes with all three credit bureaus
• File a police report documenting the identity theft
• Request your medical records to check for unauthorized entries
• Keep a detailed log of every hour and dollar spent resolving the theft

These records become your evidence for a higher-tier payout in the settlement.

Frequently Asked Questions

How much will I get from the Change Healthcare class action lawsuit?

Most claimants can expect between $50 and $500 for basic data exposure.

If you can document identity theft or financial losses, payouts could reach $5,000 to $25,000 or more.

The exact amount depends on the final settlement fund size and your individual documentation.

What is the deadline to file a Change Healthcare lawsuit claim?

No official claims deadline has been set yet because the settlement is still being finalized.

The claims window is expected to open in mid to late 2026 with a filing period of 90 to 180 days.

Watch for court announcements and breach notification updates for exact dates.

Am I eligible for the Change Healthcare data breach settlement?

You are likely eligible if your personal, medical, or financial data was processed through Change Healthcare’s systems.

If you received a breach notification letter from Change Healthcare or UnitedHealth Group, you almost certainly qualify.

Even people who never heard of Change Healthcare may be eligible because the company processed claims behind the scenes.

How do I join the Change Healthcare class action lawsuit?

You are automatically included in the class action unless you actively opt out.

When the settlement is approved, a claims portal will open where you can submit a proof of claim form.

Registering with plaintiffs’ law firms now ensures you receive updates when the filing window opens.

When will Change Healthcare lawsuit payments be sent out?

Payments are not expected until late 2026 at the earliest, and more likely in 2027.

The court must first approve the settlement, then process all claims before distributing funds.

Complex class actions typically take 6 to 12 months from final approval to first payments.

This case is moving. If you were affected by the Change Healthcare breach, 2026 is the year to act.

Start gathering your documents now. Save breach notification letters, bank statements, credit reports, and any evidence of identity theft or fraud.

When the claims portal opens, be ready to file. The people who prepare early and document thoroughly will receive the largest payouts.

Readers also liked: Business Lawsuit Israel 2026: Full Filing and Payout Guide

Never Miss a Lawsuit Update

Mark Lawfold as a Preferred Source so you never miss a settlement deadline or new filing.