Nebraska sues Change Healthcare over security failings that led to medical data breach of over 100 million Americans

Nebraska has sued Change Healthcare following a February ransomware attack attributed to the Russian-speaking ALPHV (BlackCat) gang that exfiltrated terabytes of sensitive medical, personal, and financial data affecting over 100 million Americans. The complaint alleges basic security failures (no MFA, poor segmentation), use of a stolen low-level support credential to gain initial access, nine days of undetected lateral movement and privilege escalation, widespread operational disruption to care and claims processing, and delayed notification to affected individuals.