Change Healthcare lists the medical data stolen in ransomware attack

UnitedHealth confirmed that a February ransomware attack on its Change Healthcare subsidiary, attributed to the BlackCat/ALPHV group, resulted in the theft of approximately 6 TB of data containing health insurance, medical, billing, and personal identifiers for a substantial portion of Americans (CEO estimated up to ~1/3). The incident caused nationwide healthcare billing outages, involved stolen credentials and lack of MFA on Citrix, included at least one ransom payment (reported ~$22M) and subsequent leaking/demand activity on a data-leak site, and has produced over $872M in losses to date; affected individuals will receive breach notifications and offered credit monitoring.