Change Healthcare Was Fine—Until UnitedHealth Bought It and Paid Hackers $22 Million to Restore Operations

Before UnitedHealth acquired it, Change Healthcare operated as a crucial but under-the-radar backbone of the U.S. healthcare infrastructure. It processed insurance claims, handled reimbursements, enabled pharmacy services, and quietly kept hospitals and clinics financially afloat. By all accounts, it worked. It wasn’t broken.

Then came the acquisition.

UnitedHealth Group, through its Optum subsidiary, finalized the purchase of Change Healthcare in late 2022. It was a $13 billion consolidation move—one of many in UnitedHealth’s ongoing campaign to vertically integrate as much of the healthcare system as it can, from payers to providers to the pipes in between.

By February 2024, Change Healthcare—now fully under UnitedHealth’s ownership—was the target of a devastating ransomware attack. The attack brought key systems to a standstill: prescription processing froze, billing platforms crashed, and providers across the country were cut off from vital revenue streams. Millions of patients and thousands of clinics were impacted. And UnitedHealth, one of the largest companies in the country, ended up paying $22 million to the attackers to restore access.

That single act—a multibillion-dollar company paying off cybercriminals—raises massive questions about how such a critical system was left so vulnerable. What was once stable infrastructure had become a single point of failure. And the consequences of that failure are now spilling into the courts.

The Lawsuits Are Flooding In

In the months since the breach, a wave of lawsuits has been filed against UnitedHealth, Change Healthcare, and Optum. Providers, health systems, and medical groups have all come forward with claims of financial damage caused by the system outage.

One such case is BPW Medical Associates v. Change Healthcare, Optum, and UnitedHealth, filed in federal court in May 2025. BPW alleges they lost over $600,000 in frozen accounts receivable during the system downtime. Instead of reimbursing that loss, UnitedHealth offered a short-term “loan” and then, according to the complaint, wrote off the outstanding receivables without justification. That strategy, the suit claims, left BPW exposed and financially damaged—without meaningful recourse.

And BPW is not alone. The breach has triggered dozens of lawsuits, many of which have now been consolidated into a multidistrict litigation (MDL) proceeding in the District of Minnesota. The Judicial Panel on Multidistrict Litigation formally recognized the scope of the breach and its fallout by grouping these cases together for coordinated pre-trial handling.

These lawsuits allege a range of legal violations:

• Negligence in safeguarding critical systems
• Breach of contract with providers dependent on timely payment
• Unjust enrichment, by offering loans instead of honoring actual liabilities
• Violation of data protection obligations, due to the exposure of sensitive patient and provider data

Some plaintiffs are also calling into question UnitedHealth’s overall handling of the crisis, alleging that the company provided inadequate communication, unclear support, and financial relief programs that benefited UnitedHealth more than the impacted providers.

A Broader Failure of Oversight

This legal wave is more than just the natural consequence of a breach—it’s a referendum on UnitedHealth’s business model. The Change Healthcare crisis didn’t come from a hostile market or a surprise legal shift. It came from within: from how UnitedHealth assumed control of a critical infrastructure provider, failed to secure it, and then scrambled to contain the damage after it collapsed.

The sudden pause of UnitedHealth’s acquisition of VitalCare, a home healthcare company, further reinforces the view that the company is expanding faster than it can manage. The Change fallout has drawn regulatory and legal scrutiny, and it’s now impacting the company’s ability to continue consolidating.

The lawsuits will take months, possibly years, to resolve. But their message is immediate: UnitedHealth took on more than it could handle, failed to protect the system it absorbed, and left a trail of financial, operational, and legal damage in its wake.

This isn’t just about a ransom payment. It’s about whether a single corporation can be allowed to control so much of the healthcare system without appropriate oversight, accountability, or infrastructure resilience. Change Healthcare was fine—until UnitedHealth bought it. The aftermath is still unfolding, one lawsuit at a time.

IF YOU NEED A LAWYER CONTACT US