UnitedHealth Group says Change Healthcare attack cost $872 million to remediate

Minnesota-based UnitedHealth Group says it has incurred a loss of $872 million so far due to a major cyber security incident that impacted its subsidiary Change Healthcare earlier this year.

In a recent filing with the U.S. Securities and Exchange Commission, the healthcare service provider said that the loss of $872 million includes $593 million in direct cyberattack response costs and $279 million due to business disruptions.

“Out of prudence, due to the potential for the cyberattack to affect claims receipt timing, the company reflected an additional $800 million of claims reserves,” UnitedHealth said.

“Cash flows from operations from the first quarter 2024 were $1.1 billion and were affected by approximately $3 billion due to the company’s cyberattack response actions, including funding acceleration to care providers, and were additionally impacted due to the timing of public sector cash receipts,” it added in its SEC filing.

UnitedHealth Group also stated that it estimates a loss of $350 to $450 million for the rest of the year due to the business disruptions caused by the data security incident.

The healthcare group has assured its clients and investors that Change Healthcare’s affected systems have been restored successfully with pharmacy claims and payment platforms functioning at 80% capacity.

In a statement shared with the media, Andrew Witty, chief executive officer of UnitedHealth Group, said, “The core story at UnitedHealth Group remains our colleagues delivering improved experiences for the people we serve and driving balanced growth even while swiftly and effectively addressing the attack on Change Healthcare.”