A judge has cleared the way for Nebraska to continue its lawsuit against Change Healthcare and its parent company, UnitedHealth Group, over a ransomware attack that compromised sensitive data for nearly half the state’s residents.
In December 2024, Nebraska Attorney General Mike Hilgers filed a lawsuit in Lancaster County District Court, alleging Change Healthcare violated Nebraska’s consumer protection and data security laws. The lawsuit stems from a February cyberattack on Change Healthcare that allowed hackers to steal personal data and deploy ransomware.
Judge Strong rejected the companies’ motion to dismiss, ruling that the state’s allegations were sufficient to proceed.
In a Nov. 13 news release, Mr. Hilgers said the ruling allows the state to continue seeking accountability and stronger protections for health data. He said the breach caused significant disruptions for hospitals, pharmacies and healthcare providers across Nebraska.
The case now enters the next phase of litigation. The Attorney General’s Office said it will continue pursuing remedies under state law and aims to hold the defendants accountable for alleged security failures and delays in notifying affected residents.
“We will continue to defend ourselves vigorously,” an Optum spokesperson told a Becker’s in an emailed statement.
