⚠ 190 Million PeopleModerate threat

UnitedHealth Group (UNH) — threat to the moat

The Change Healthcare breach touched about 190 million people, and its legal consequences outlast the final accounting charge.

The Change Healthcare attack affected approximately 190 million individuals1. Beyond the immediate cost, UnitedHealth recorded $2.2 billion of direct response costs and $867 million of business disruption impacts in 20242, and litigation over the attack continues3.

Change Healthcare cyberattack costs ($M)2,200Direct response 2024867Business disruption 2024799Final charge Q4 2025UnitedHealth Group Form 10-K FY2024; FY2025 results release
About $3.9 billion of charges.

The reputational cost is harder to measure. Change Healthcare is sold to providers and payers who compete with or negotiate against UnitedHealthcare, and a breach of this size gives them a reason to spread their business.

The company closed its accounting for the attack in the fourth quarter of 2025 with a final $799 million charge4.

The first-quarter 2024 results already showed the scale: cyberattack impacts cost $0.74 a share in that quarter alone5. Together with the 2024 response costs and the final 2025 charge, the attack has cost several billion dollars before any litigation outcome.

Any new charge or settlement tied to the attack would reopen the account. A large one would say the liability was not closed after all.

References
  1. ReportedThe Change Healthcare attack affected approximately 190 million individuals.
    UnitedHealth Group Form 10-K for fiscal 2024 - the Change Healthcare cyberattack, approximately 190 million individuals, and 2024 segment results. — FY2024 · publ. February 2025 · source ↗
  2. ReportedBeyond the immediate cost, UnitedHealth recorded $2.2 billion of direct response costs and $867 million of business disruption impacts in 2024, and litigation over the attack continues.
    UnitedHealth Group Form 10-K for fiscal 2024 - the Change Healthcare cyberattack, approximately 190 million individuals, and 2024 segment results. — FY2024 · publ. February 2025 · source ↗
  3. ReportedBeyond the immediate cost, UnitedHealth recorded $2.2 billion of direct response costs and $867 million of business disruption impacts in 2024, and litigation over the attack continues.
    UnitedHealth Group Form 10-Q for the quarter ended 30 June 2026 - segment note on the 2026 basis, share repurchases, legal matters and the IRS notices. — Q2 2026 · publ. 10 August 2026 · source ↗
  4. ReportedThe company closed its accounting for the attack in the fourth quarter of 2025 with a final $799 million charge.
    UnitedHealth Group fourth-quarter and full-year 2025 results release and 2026 outlook, Form 8-K exhibit 99.1. — FY2025 · publ. 27 January 2026 · source ↗
  5. ReportedThe first-quarter 2024 results already showed the scale: cyberattack impacts cost $0.74 a share in that quarter alone.
    UnitedHealth Group first-quarter 2024 results release, Form 8-K exhibit 99.1 - cyberattack impacts. — Q1 2024 · publ. 16 April 2024 · source ↗
Sources
Generated September 26, 2026