UNITEDHEALTH GROUP INC
Feb 2024 · Graded Verified · Healthcare and Life Sciences · Government record
Incident summary
UNITEDHEALTH GROUP INCFeb 2024
$3.09B
Total reported cost
Total incident cost
The intrusion reached Change Healthcare through a Citrix portal with no second factor, one stolen credential opening a clearinghouse that routes roughly a third of American medical claims. Nine quiet days later the records of about 192.7 million people were gone, the largest healthcare breach on record, because a country wired its billing through a single chokepoint and guarded it with a password. UnitedHealth paid $22 million to bury the files, then watched a second crew arrive to extort the same data again.
Losses on the record
$867M
Orders & sales lost
Business interruption
FY2024$3.09B
FY2025+ $799M
to date$3.89B
Our sum across non-overlapping fiscal periods; not a single company-stated figure.
These measure different things and are never added together.
See the full accounting
Total incident cost · realized$3.09B · V
Direct expense · realized$2.2B · V
Business interruption · realized$867M · V
Shown individually, never summed across measures.
Verified: the linked document states this figure.
SEC 8-K, Item 1.05
Initial attack type compromised credentials confirmed · Impact data theft confirmed + data extortion
Quantified 15 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
About this record
This incident is on the public government record: an SEC 8-K filing or a state-regulator notification, graded Verified. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.