Change HealthCare - OPTUM Group - United HealthCare Group Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 8, 2024, the ransomware group known as ransomhub listed Change HealthCare - OPTUM Group - United HealthCare Group on its leak site, claiming to have taken internal files in a ransomware attack. The listing notes a claimed data size of 4TB and records 38 visits, with the material marked as not yet published. The number of people affected remains unknown.

For patients, employees, providers, and business partners whose information may sit inside those files, the practical stakes are immediate: health-related records and internal operational data can enable identity misuse, insurance fraud, targeted phishing, or long-term privacy harm. Public detail is limited, so the full picture of what was taken and who is touched has not been confirmed beyond the group's claim.

Breaking down the breach

According to the available record, Change HealthCare - OPTUM Group - United HealthCare Group was listed by the ransomhub ransomware group on April 8, 2024. The group claims that internal files were exfiltrated in a ransomware attack and that the volume of data involved is 4TB. The listing shows 38 visits and states that the material has not been published. No further technical details—such as the initial access method, the precise date of intrusion, or any ransom demand—are disclosed in the public facts. The number of individuals potentially affected is listed as unknown. Because the listing itself is a claim by the threat actor and the data has not been published, independent verification of the full scope remains unavailable at this time.

Who is ransomhub?

Ransomhub is a ransomware operation that has been publicly documented as a Ransomware-as-a-Service (RaaS) group. Like many such actors, it typically gains access to corporate networks, encrypts systems, and exfiltrates data before threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has been observed listing a range of victims across sectors and using double-extortion tactics—combining encryption with the threat of data release. Its leak site serves as both a pressure tool and a public claim of responsibility. In this case, the group claims to have listed Change HealthCare - OPTUM Group - United HealthCare Group and to hold 4TB of internal files; those assertions have not been independently confirmed beyond the listing itself. Public reporting on ransomhub has noted its relatively recent emergence and its practice of advertising victims with claimed data volumes, but no additional statements specific to this incident appear in the provided facts.

About Change HealthCare - OPTUM Group - United HealthCare Group

Change Healthcare operates as a major healthcare technology and revenue-cycle management company; it is part of the OPTUM Group, which itself sits under UnitedHealth Group, one of the largest health-insurance and care-delivery organizations in the United States. Entities of this kind process vast volumes of clinical, billing, pharmacy, and administrative data on behalf of providers, payers, and patients. They sit at the center of claims processing, electronic health-record connectivity, and payment systems. A breach involving such an organization is consequential because the data it handles often includes sensitive personal health information, insurance identifiers, and business records that can affect millions of people and thousands of healthcare facilities. Even when the exact contents of an incident remain unconfirmed, the sector's role in the healthcare ecosystem means any compromise carries elevated privacy and operational risk.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the claimed volume is 4TB. No more granular inventory of data types—such as patient names, Social Security numbers, medical records, or financial details—is named. Organizations of this scale and sector typically hold protected health information, claims data, provider credentials, employee records, and proprietary business documents. Because the exact contents remain unconfirmed and the material has not been published, it is not possible to state with certainty which specific categories were taken. Readers should treat the exposure as potentially involving sensitive internal and health-related information until official disclosures provide clarity.

What's at stake

For individuals whose data may be involved, the real-world risks include identity theft, fraudulent insurance claims, medical identity misuse, and highly targeted phishing or social-engineering attempts that reference genuine personal or clinical details. Even partial internal files can contain enough context to make scams more convincing. For the organization, the stakes include operational disruption, regulatory scrutiny under health-privacy rules, potential contractual liabilities with providers and payers, and reputational damage that can affect trust across the healthcare supply chain. Because the number of people affected is unknown and the data has not been published, the full extent of downstream harm cannot yet be measured; the absence of publication does not eliminate the risk that the material could still be used or released later.

What to do if you're exposed

If you have a relationship with Change Healthcare, OPTUM, or UnitedHealth Group—as a patient, employee, provider, or partner—treat the possibility of exposure seriously even while official confirmation of individual impact is pending. Practical first steps include:

• Monitor bank, credit-card, and insurance statements for unfamiliar activity and set up fraud alerts with the major credit bureaus.
• Be alert to phishing emails or calls that reference medical bills, claims, or account updates; verify any such contact through official channels rather than links or numbers supplied in the message.
• Request a free annual credit report and consider a credit freeze if you see signs of misuse.
• Keep records of any notices you receive from the organization and follow any official guidance they issue.
• Run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets.

Public detail on this incident remains limited to the ransomhub listing of April 8, 2024, the claimed 4TB of internal files, and the note that the material has not been published. Stay attentive to verified updates from the organization itself rather than relying solely on threat-actor claims.

AICompiled with AI assistance from public sources and published under our editorial standards.