Change Healthcare Data Breach Lawsuit: 2026 Guide

Never Miss a Lawsuit Update

Mark Lawfold as a Preferred Source so you never miss a settlement deadline or new filing.

The Change Healthcare data breach lawsuit is one of the largest healthcare privacy cases in American history, and 2026 is shaping up to be the year it matters most. Over 100 million people had their sensitive medical and personal data exposed when hackers hit Change Healthcare in February 2024.

If you got a breach notification letter, you are likely part of this case. Settlements could reach billions of dollars. Individual payouts may range from a few hundred to several thousand dollars depending on what data was stolen and how it harmed you.

This guide covers everything happening in 2026. You will learn who qualifies, what the latest court updates look like, estimated payout ranges, filing deadlines, and exactly how to submit a claim. The numbers involved are staggering, and the clock is ticking.

You might also find this useful — Lebanon CT Budget Shortfall Lawsuit 2026: What You Need

Change Healthcare Data Breach Lawsuit

The Change Healthcare data breach lawsuit is a massive legal action against Change Healthcare and its parent company, UnitedHealth Group, for failing to protect the personal and medical data of over 100 million Americans. The case alleges negligence, violations of HIPAA standards, and breach of fiduciary duty.

In February 2024, the BlackCat (also known as ALPHV) ransomware group attacked Change Healthcare’s systems. The breach shut down pharmacy claims processing, medical billing, and insurance verification across the country for weeks. Hospitals, clinics, and pharmacies could not process patient transactions.

The attack exposed names, Social Security numbers, health insurance IDs, medical diagnoses, treatment records, billing information, and banking details. It was not just a data breach. It was a full-scale disruption of the U.S. healthcare system.

Hundreds of individual lawsuits were filed within months. Federal courts consolidated them into a single multidistrict litigation case.

The case is now in active litigation. It’s one of the biggest data breach lawsuits ever filed in the U.S.

Change Healthcare Class Action Lawsuit 2026

The Change Healthcare class action lawsuit in 2026 is moving through critical pretrial phases in Minnesota federal court. This year is expected to bring class certification rulings and possibly early settlement discussions.

Judge Donovan Frank has been overseeing MDL No. 3108 since the cases were consolidated. Throughout 2025, the court handled initial motions, discovery disputes, and the appointment of lead counsel. In 2026, the litigation enters a more advanced stage.

Class certification is one of the biggest milestones ahead. If the court certifies the class, it means the lawsuit can proceed on behalf of all affected individuals at once, rather than requiring each person to file separately. That decision could come in mid to late 2026.

Bellwether trials, which are test cases used to gauge how juries respond to the evidence, may also be scheduled. These trials help both sides evaluate settlement value.

• Class certification hearings expected in 2026
• Bellwether trial selection may begin late 2026
• Discovery deadlines are ongoing through the year
• Lead plaintiffs’ counsel continues gathering evidence from UnitedHealth Group

This is the year the case starts to take real shape. The decisions made in 2026 will set the stage for any future settlement or trial outcome.

Change Healthcare Lawsuit Update 2026

The most important Change Healthcare lawsuit update for 2026 is that the case remains active, discovery is ongoing, and no settlement has been reached yet. The litigation is progressing through pretrial phases in the District of Minnesota.

As of early 2026, UnitedHealth Group has been required to produce internal documents related to its cybersecurity practices before the attack. Plaintiffs’ attorneys have argued that the company knew about vulnerabilities and failed to act. UnitedHealth Group has pushed back, claiming it took reasonable steps to protect data.

One key development: UnitedHealth Group CEO Andrew Witty testified before Congress in 2024, admitting the company paid a $22 million ransom to the hackers. That admission is now part of the legal record and could play a role in proving negligence.

The court has also addressed motions to dismiss filed by the defense. Several claims survived those challenges, which means the lawsuit has legal legs.

Stay aware of court updates as they happen. Developments this year will directly influence your claim value.

Key Takeaway: The Change Healthcare data breach lawsuit is one of the largest in history, and 2026 is a pivotal year for class certification, discovery, and the potential start of settlement talks.

Change Healthcare Data Breach Settlement

A Change Healthcare data breach settlement has not been finalized as of 2026, but legal experts expect negotiations to begin in earnest this year or early 2027. The case’s massive scope makes a settlement far more likely than a full trial.

Data breach class actions of this size almost always settle. Going to trial with 100 million class members is logistically impractical for both sides. UnitedHealth Group has strong financial incentives to resolve the case before a jury verdict could result in an unpredictable, potentially enormous damages award.

The settlement fund could reach into the billions. For comparison, the Equifax data breach settlement in 2019 totaled $700 million and affected about 147 million people. The Change Healthcare breach is similar in scale but involves far more sensitive medical data, which could push the total higher.

Several factors will determine the final settlement amount:

• Total number of affected individuals who file claims
• Types of data exposed per claimant
• Evidence of actual harm (identity theft, financial loss, emotional distress)
• UnitedHealth Group’s willingness to negotiate vs. fight at trial
• Court rulings on class certification and liability

Think of it like a pie. The bigger the settlement fund, the more each slice is worth. But the number of people claiming a slice matters too. If only 10% of eligible people file, individual payouts go up significantly.

No one should expect a check tomorrow. But the groundwork for a settlement is being laid right now in 2026.

How Much Will Change Healthcare Settlement Pay

Most estimates suggest individual payouts from the Change Healthcare settlement could range from $100 to $5,000 or more, depending on the type and severity of harm each person experienced. Higher payouts are expected for victims who suffered identity theft or financial fraud.

Settlement calculations in data breach cases depend on tiered structures. People with minor exposure get a base payment. Those who can prove actual damages receive significantly more.

These figures are estimates based on comparable data breach settlements. The actual amounts will depend on the final settlement terms negotiated between plaintiffs’ counsel and UnitedHealth Group.

Keep every piece of documentation you have. Bank statements showing fraudulent charges, credit monitoring alerts, receipts for identity theft protection services, and records of time spent dealing with the breach all strengthen your claim.

The more evidence of harm you can show, the higher your payout tier. People who simply wait for a base payment without filing proper documentation will get the minimum.

Change Healthcare Data Breach Lawsuit Payout

The Change Healthcare data breach lawsuit payout timeline is still uncertain, but claimants should not expect payments before late 2027 at the earliest. Settlement negotiations have not concluded, and the court must approve any deal before money is distributed.

Here is how the payout process typically works in a case like this:

1. Parties reach a settlement agreement
2. Court grants preliminary approval
3. Class members receive notice and can file claims
4. Objection and opt-out period opens
5. Court grants final approval after a fairness hearing
6. Claims administrator processes and distributes payments

Each step takes months. The entire process from preliminary approval to checks in hand usually runs 12 to 18 months.

• No payout has been issued yet as of 2026
• Settlement talks may begin in late 2026
• If a deal is reached in 2027, payments could arrive in late 2027 or 2028
• Some claimants may receive expedited payments if a settlement includes fast-track provisions

Patience matters here. But so does preparation. Filing your claim as soon as the window opens gives you the best chance of receiving your full payout without delays.

Key Takeaway: While no settlement money is available yet, estimated individual payouts range from $100 to $5,000 or more, with documented harm cases potentially receiving even higher amounts.

Who Qualifies for Change Healthcare Lawsuit

Anyone whose personal, medical, or financial data was exposed in the February 2024 Change Healthcare cyberattack likely qualifies for this lawsuit. That includes patients, healthcare providers, and pharmacy customers whose records flowed through Change Healthcare’s systems.

Change Healthcare processed roughly one in three U.S. healthcare transactions. That means even if you never heard of the company, your data may have passed through their network when you visited a doctor, filled a prescription, or used your health insurance.

You likely qualify if:

• You received a breach notification letter from Change Healthcare or Kroll (the notification administrator)
• You used a pharmacy, hospital, or clinic that processes claims through Change Healthcare
• You had health insurance through UnitedHealthcare, Optum, or affiliated plans
• Your name appeared on a list of affected individuals maintained by HHS

You do not need to prove that your data was actually misused. Simply having your information exposed during the breach is enough to be part of the class in most data breach lawsuits.

If you are unsure, check with the claims administrator once the filing window opens. You can also search your name in breach databases or contact your health insurance provider.

Change Healthcare Data Breach Affected Patients

The Change Healthcare data breach affected an estimated 100 million patients, making it the largest healthcare data breach ever reported to the U.S. Department of Health and Human Services. Every state in the country has affected individuals.

Patients were affected even if they had no direct relationship with Change Healthcare. The company operates behind the scenes, acting as a clearinghouse between healthcare providers, insurance companies, and pharmacies. If you saw a doctor or filled a prescription in the U.S., there’s a reasonable chance your data was in their system.

Specific groups of affected patients include:

• UnitedHealthcare members
• Optum pharmacy customers
• Patients of hospitals and clinics using Change Healthcare for billing
• People with Medicaid or Medicare processed through the company’s network
• Military and veteran healthcare recipients using Tricare systems connected to Change Healthcare
• Anyone who filled prescriptions at pharmacies relying on the platform

The breach disproportionately impacted people with chronic conditions. Why? Because those patients generate more claims, more records, and more data flowing through Change Healthcare’s network.

Breach notification letters were sent in waves starting in mid-2024 and continuing into 2025. If you moved or changed addresses, you may have missed yours. Check with Kroll or the Change Healthcare breach response website for your status.

What Data Was Exposed in Change Healthcare Breach

The Change Healthcare breach exposed an extraordinarily wide range of sensitive data, including Social Security numbers, medical diagnoses, prescription histories, health insurance details, and financial account information. This is not a simple email-and-password breach.

Here is a breakdown of the specific data types compromised:

Not everyone had every data type exposed. Some individuals only had names and insurance IDs compromised. Others had their complete medical and financial profiles stolen.

The most damaging exposure involves Social Security numbers combined with medical records. That combination enables medical identity theft, where criminals use your information to receive healthcare services, obtain prescription drugs, or file fraudulent insurance claims in your name.

Readers also liked: Clinique Advertising Dispute Model Lawsuit 2026 Updates

Medical identity theft is harder to detect than financial identity theft. It can take months or years before victims notice inaccurate entries in their health records.

Key Takeaway: Over 100 million patients had data ranging from names to Social Security numbers to full medical histories exposed, and those with the most sensitive data compromised face the highest risk of identity theft.

Change Healthcare Cyberattack Lawsuit

The Change Healthcare cyberattack lawsuit centers on allegations that the company failed to implement adequate cybersecurity protections, leaving its systems vulnerable to a sophisticated ransomware attack by the BlackCat/ALPHV hacking group.

The attack began on February 21, 2024. Hackers gained access to Change Healthcare’s network and deployed ransomware that encrypted critical systems. The company’s entire platform went offline, disrupting healthcare operations nationwide for weeks.

Plaintiffs allege several key failures:

• Change Healthcare did not use multifactor authentication on critical systems
• Known security vulnerabilities were left unpatched for months
• The company failed to segment its network to contain breaches
• Internal cybersecurity audits identified risks that were not addressed
• UnitedHealth Group prioritized cost savings over security upgrades

UnitedHealth Group CEO Andrew Witty confirmed during congressional testimony that the hackers entered through a portal that lacked multifactor authentication. That single missing safeguard opened the door to the largest healthcare data breach in U.S. history.

The ransom payment adds another layer. UnitedHealth Group paid approximately $22 million to the attackers, yet the stolen data was still leaked on the dark web. Paying the ransom did not protect victims.

This is not a case where hackers outsmarted cutting-edge defenses. Plaintiffs argue it’s a case where basic security practices were ignored. That distinction matters enormously in proving negligence.

UnitedHealth Group Data Breach Lawsuit

The UnitedHealth Group data breach lawsuit holds the parent company directly responsible for the failures at its subsidiary, Change Healthcare. Plaintiffs argue that UnitedHealth Group, as the owner and operator, had ultimate authority over cybersecurity decisions and budget.

UnitedHealth Group acquired Change Healthcare in 2022 for approximately $13 billion. After the acquisition, the company was responsible for integrating Change Healthcare’s technology systems into its broader infrastructure. Plaintiffs claim that process was mismanaged.

Key arguments against UnitedHealth Group include:

• The company knew Change Healthcare’s legacy systems had security weaknesses
• Post-acquisition cybersecurity integration was delayed or deprioritized
• UnitedHealth Group’s annual revenue exceeds $370 billion, making security investment failures inexcusable
• The company’s response to the breach was slow and inadequate

UnitedHealth Group reported spending over $2.5 billion on breach response costs through 2025. That figure includes customer notification, credit monitoring, legal fees, and operational recovery. Those costs signal how seriously the company takes its exposure.

The fact that UnitedHealth Group is one of the largest companies in the world works in plaintiffs’ favor. Courts and juries expect companies with massive resources to invest appropriately in data protection.

How to File Change Healthcare Data Breach Claim

To file a Change Healthcare data breach claim, you will need to submit a proof of claim form through the official claims administrator once the court-approved filing window opens. That window has not opened yet as of early 2026, but you can prepare now.

Here is what you should do today:

1. Save your breach notification letter. This is your primary proof that you were affected.
2. Document any identity theft or fraud. Keep copies of fraudulent charges, unauthorized accounts, and credit report errors.
3. Track your time. Record hours spent dealing with the breach, including phone calls, credit freezes, and account monitoring.
4. Keep receipts. If you paid for identity theft protection, credit monitoring, or credit freezes, save those receipts.
5. Monitor your credit. Use the free monitoring offered through the breach response. Set up fraud alerts with all three credit bureaus.

When the claim form becomes available, you will likely need:

• Your name and contact information
• The breach notification you received
• Description of data types exposed
• Evidence of any harm suffered
• Receipts for out-of-pocket expenses
• A signed declaration under penalty of perjury

Think of this like preparing your tax documents. The more organized you are before the filing window opens, the smoother and faster your claim process will be.

Key Takeaway: You cannot file a claim yet, but preparing your documentation now, especially evidence of identity theft, fraud, or out-of-pocket costs, will position you for the highest possible payout.

Change Healthcare Lawsuit Deadline

No official Change Healthcare lawsuit deadline for filing individual claims has been set as of 2026 because the settlement has not been finalized. However, there are time-sensitive actions you should take right now.

Once a settlement is approved, class members typically receive 60 to 120 days to file a claim. Missing that window means forfeiting your right to compensation. Courts rarely grant extensions.

For those considering opting out of the class action to file an individual lawsuit, statutes of limitations apply. These vary by state but generally range from two to four years from the date of the breach or from when you discovered the harm.

Since the breach occurred in February 2024, some state statute of limitations clocks could start expiring as early as February 2026. If you plan to file an individual lawsuit outside the class action, consult with an attorney about your state’s specific deadlines.

For the class action itself, the most important thing is to stay informed. Sign up for updates through the claims administrator when that option becomes available.

Change Healthcare MDL Status

The Change Healthcare MDL (multidistrict litigation), designated as MDL No. 3108, is centralized before Judge Donovan Frank in the U.S. District Court for the District of Minnesota. As of 2026, the case is in active pretrial litigation.

MDL is a procedural tool used when dozens or hundreds of similar lawsuits are filed across the country. Instead of having each case proceed separately in different courts, they are grouped together for pretrial purposes. This saves time, reduces conflicting rulings, and allows coordinated discovery.

Here is where things stand:

• Lead counsel has been appointed to represent the plaintiffs’ class
• Discovery is ongoing, with UnitedHealth Group producing internal documents
• Expert witnesses are being identified by both sides
• Motions to dismiss have been partially resolved, with key claims surviving
• Class certification briefing is expected in mid 2026

Once pretrial proceedings wrap up, the MDL judge may remand individual cases back to their original courts for trial, or the parties may reach a global settlement that resolves everything at once. Given the size of this case, a global settlement is the most likely outcome.

Change Healthcare Breach Notification

Change Healthcare breach notification letters were sent to affected individuals starting in June 2024 and continuing in waves through early 2025. If you received one, you are a confirmed member of the affected class.

The notifications were managed by Kroll, a third-party breach response company hired by Change Healthcare. Letters went out via U.S. mail to the most recent address on file. Email notifications were also sent in some cases.

Each letter included:

• Confirmation that your data was involved in the breach
• A list of the specific data types exposed for your account
• Instructions for enrolling in free credit monitoring and identity protection services
• Contact information for the breach response call center
• Steps to place fraud alerts or credit freezes

If you did not receive a notification, that does not necessarily mean you were unaffected. Some letters were returned as undeliverable due to outdated addresses. Others may have been sent to a previous address.

You can check your status by:

Worth reading: Social Media Addiction Lawsuit: 2026 Payouts Guide

• Calling the Change Healthcare breach response line
• Visiting the breach response portal (search for “Change Healthcare breach” for the official site)
• Contacting your health insurance provider to ask if your data was processed through Change Healthcare

Do not ignore the notification letter. It is your ticket to free identity protection services and, eventually, your claim form for the settlement. Keep it somewhere safe.

Key Takeaway: If you received a breach notification letter, keep it safe as it’s your primary proof of eligibility, and if you haven’t received one, proactively check your status since millions of letters went to outdated addresses.

A closely related topic: Young Durham Real Estate Lawsuit 2026: Full Claim Guide

Change Healthcare Data Breach Compensation

Change Healthcare data breach compensation will likely include both monetary payments and non-monetary benefits like extended credit monitoring. The total value of your compensation package depends on the type of harm you experienced.

Data breach settlements typically offer several forms of compensation:

Monetary Compensation:

• Base cash payment for all class members (estimated $100 to $500)
• Enhanced payment for identity theft victims (estimated $2,000 to $5,000+)
• Reimbursement for out-of-pocket expenses (documented costs)
• Lost time compensation (usually $25 to $35 per hour, capped at a set number of hours)

Non-Monetary Benefits:

• Free credit monitoring (typically 3 to 5 years)
• Identity restoration services
• Dark web monitoring
• Insurance coverage for future identity theft losses

The total settlement fund could range from $1 billion to $5 billion based on comparable cases and the severity of the breach. UnitedHealth Group’s massive financial resources make a large fund feasible.

Your individual share depends on your documentation. People who file detailed claims with evidence of actual harm will receive multiples of what passive claimants receive. This is your incentive to start preparing now.

Change Healthcare Identity Theft Protection

Change Healthcare is offering free identity theft protection services to all affected individuals, including two years of credit monitoring through Kroll’s monitoring platform. You can enroll using the code provided in your breach notification letter.

The free protection package includes:

• Credit monitoring across all three bureaus (Equifax, Experian, TransUnion)
• Dark web monitoring to detect if your data appears in criminal marketplaces
• Identity restoration services with a dedicated case manager if fraud is detected
• $1 million identity theft insurance to cover losses from future identity theft

Enrollment is available regardless of whether you join the lawsuit. These services are separate from any settlement compensation.

Beyond the free services, consider taking these additional steps:

• Place a credit freeze with all three credit bureaus (this is free and blocks new accounts from being opened in your name)
• Set up fraud alerts on your credit reports
• Review your medical records for unfamiliar treatments, prescriptions, or diagnoses
• Monitor your health insurance explanation of benefits statements for services you did not receive
• File a report with the FTC at their identity theft reporting portal

Medical identity theft is especially insidious. If someone uses your information to obtain medical care, their health data gets mixed with yours. That can affect future diagnoses, insurance coverage, and even emergency treatment decisions. Check your records regularly.

Frequently Asked Questions

How do I know if my data was exposed in the Change Healthcare breach?

You likely received a breach notification letter from Change Healthcare or Kroll starting in mid-2024.

If you did not receive a letter, contact the Change Healthcare breach response line or check with your health insurance provider.

Anyone who used healthcare services processed through Change Healthcare’s network may be affected.

What is the deadline to file a Change Healthcare data breach claim?

No official claim filing deadline has been set because the settlement is not finalized yet.

Once a settlement is approved, class members will typically have 60 to 120 days to file.

Watch for court announcements in late 2026 or 2027 for specific dates.

How much money could I get from the Change Healthcare settlement?

Most claimants can expect between $100 and $5,000, depending on the type of data exposed and proof of harm.

Victims of identity theft or financial fraud may receive significantly more.

Actual payouts will be determined by the final settlement terms.

Is there a class action lawsuit against Change Healthcare in 2026?

Yes, the class action is active and consolidated as MDL No. 3108 in the U.S. District Court for the District of Minnesota.

The case is in pretrial litigation with class certification expected in 2026.

Over 50 individual lawsuits have been consolidated into this single proceeding.

Do I need a lawyer to join the Change Healthcare data breach lawsuit?

No, you do not need your own attorney to participate in the class action.

Lead counsel appointed by the court represents all class members automatically.

If you want to file an individual lawsuit or opt out of the class, then retaining a personal attorney is recommended.

This case is far from over, and 2026 is when the real legal action heats up. Your next step is simple: gather your documents, save your breach notification letter, and enroll in the free credit monitoring if you haven’t already.

When the claim filing window opens, be ready to submit immediately. The people who prepare now will be in the strongest position to receive maximum compensation.

Your data was compromised. Your rights matter. Don’t let this deadline pass you by.

A related guide: XRP Coinbase Lawsuit: Unregistered Security Guide 2026

This is also helpful — Applebee’s Class Action Lawsuit Junk Fee: 2026 Guide

Along the same lines: Business Lawsuit Israel 2026: Full Filing and Payout Guide

Never Miss a Lawsuit Update

Mark Lawfold as a Preferred Source so you never miss a settlement deadline or new filing.