Press Release

Attorney General Taylor Shares Resources for Consumers Following the Change Healthcare (a Unit of UnitedHealth) Cyberattack

July 9, 2024

(Anchorage, AK) – Alaska Attorney General Treg Taylor is sharing consumer protection reminders and raising awareness about the availability of free credit monitoring and identity theft protection services following an unprecedented data breach in February at Change Healthcare.

Change Healthcare, a unit of UnitedHealth, is the nation’s biggest electronic data clearinghouse. Change Healthcare's technological infrastructure is used by tens of thousands of providers, pharmacies, and insurers to verify insurance, confirm pre-authorization of procedures or services, exchange insurance claim data, and perform other administrative tasks essential to the delivery of health care.

The February cyberattack interrupted operations for thousands of doctors’ offices, hospitals, and pharmacies. It also resulted in Americans’ sensitive health and personal data being leaked onto the dark web - a hidden portion of the Internet where cyber criminals buy, sell, and track personal information. The actual number and identity of affected patients is unknown.

Change Healthcare has publicly stated that the data breach could impact up to 1/3 of all Americans. Accordingly, Attorney General Taylor wants to make sure Alaskans are aware of the breach and the resources available to them, including the offer that Change Healthcare has provided to the public.

“You may not have heard of Change Healthcare before, but that does not mean your data was not affected,” said Attorney General Taylor. “Your provider or insurer may have been a Change Healthcare customer. I encourage Alaskans to take advantage of the resources described in this release.”

Change Healthcare is offering free credit monitoring and identity theft protections for two years for all Alaska residents who believe their identification information may have been affected. The dedicated website and call center will not be able to provide specific details about whether personal data was impacted but can guide consumers through getting set up for the free credit monitoring and identity theft protections. Because of the wide impact of this breach, the safest course of action is to assume that your information has been involved.

• For information visit changecybersupport.com.
• To enroll in credit monitoring through IDX use the link at changecybersupport.com or call 1-888-846-4705.
• For additional support from Change Healthcare call 1-866-262-5342.

Consumers should be aware of potential warning signs that someone is using their medical information. The signs include:

• A bill from their doctor for services they did not receive;
• Errors in their Explanation of Benefits statement like services they never received or prescription medications they do not take;
• A call from a debt collector about a medical debt they do not owe;
• Medical debt collection notices on their credit report that they do not recognize;
• A notice from their health insurance company indicating they have reached their benefit limit; or
• They are denied insurance coverage because their medical records show a pre-existing condition they do not have.

If consumers are concerned that their data may have been impacted but prefer not to use the free resources provided by Change Healthcare, they can also consider freezing their credit.

A credit freeze prevents creditors—such as banks or lenders—from accessing individual’s credit reports. This will stop identity thieves from taking out new loans or credit cards in consumer’s names because creditors will not approve their loans or credit requests if they cannot first access their credit reports. By law, a credit bureau must allow you to place, temporarily lift, or remove a credit freeze for free.

When consumers freeze their credit with each bureau, the bureaus will send them a personal identification number. The consumers can then use that PIN to unfreeze their credit if they want to apply for a loan or credit card. Consumers can also use the PIN to freeze their credit again after they have applied for loans or a new credit card.

Consumers will have to freeze their credit with each bureau: Experian, Equifax and TransUnion.

• Equifax | https://www.equifax.com/personal/credit-report-services/credit-freeze/
  • +1 (888) 766-0008
• Experian | https://www.experian.com/freeze/center.html
  • +1 (888) 397-3742
• TransUnion | https://www.transunion.com/credit-freeze
  • +1 (800) 680-7289

Cyberattacks in the healthcare sector have increased in both frequency and severity in recent years. Data breaches involving PHI are required to be reported to the U.S. Department of Health & Human Services - Office for Civil Rights (hhs.gov) by HIPAA-covered entities. Since the beginning of this year, the portal shows data breaches impacted the PHI of nearly 38 million consumers.

Joining Attorney General Taylor in sharing these consumer protection resources is a bipartisan group of attorneys general from across the country.

# # #

Department Media Contacts: Communications Director Patty Sullivan at patty.sullivan@alaska.gov or (907) 269-6368. Information Officer Sam Curtis at sam.curtis@alaska.gov or (907) 269-6269.