On April 8, 2024, the ransomware group RansomHub listed Change Healthcare, Optum Group, and UnitedHealth Group on its leak site, claiming to have exfiltrated 4TB of internal files during a ransomware attack. The listing, which had received 38 visits at the time of publication, does not yet show the data as fully published.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
Details from the Leak-Site Listing
The primary disclosure on the RansomHub onion site states that the three related healthcare entities were targeted in a single ransomware operation. It describes the stolen material simply as internal files exfiltrated and lists the total volume as 4TB. The entry does not specify the exact number of individuals affected, the precise data types beyond the generic description, or any patient records count. The data has not been released publicly according to the listing, and no ransom demand figure is shown.
Why This Matters for You and Your Family
When a major healthcare payment and records processor like Change Healthcare is hit, the consequences reach far beyond corporate networks. Millions of Americans have claims, prescriptions, or billing records that passed through these systems. Even though the exact scope remains unknown, any exposure of internal files can include names, dates of birth, Social Security numbers, insurance details, and clinical information. For you and your family this means heightened risk of medical identity theft, fraudulent insurance claims filed in your name, and long-term credit damage that can take years to untangle.
The Doxxing and Identity-Chain Risks
Healthcare breaches rarely stop at stolen medical data. The internal files taken here can be cross-referenced with other leaks to build complete identity profiles. A single email or phone number found in these 4TB can link your work account, personal banking, and even your children’s online gaming profiles. Once attackers map those connections, they can launch targeted phishing, account takeovers, or sell the full dossier on dark-web marketplaces. Credential leaks of this nature frequently cascade into gaming account compromises because the same password or recovery email is reused across services.