A judge has cleared the way for Nebraska to continue its lawsuit against Change Healthcare and its parent company, UnitedHealth Group, over a ransomware attack that compromised sensitive data for nearly half the state’s residents.
In December 2024, Nebraska Attorney General Mike Hilgers filed a lawsuit in Lancaster County District Court, alleging Change Healthcare violated Nebraska’s consumer protection and data security laws. The lawsuit stems from a February cyberattack on Change Healthcare that allowed hackers to steal personal data and deploy ransomware.
Judge Strong rejected the companies’ motion to dismiss, ruling that the state’s allegations were sufficient to proceed.
In a Nov. 13 news release, Mr. Hilgers said the ruling allows the state to continue seeking accountability and stronger protections for health data. He said the breach caused significant disruptions for hospitals, pharmacies and healthcare providers across Nebraska.
The case now enters the next phase of litigation. The Attorney General’s Office said it will continue pursuing remedies under state law and aims to hold the defendants accountable for alleged security failures and delays in notifying affected residents.
“We will continue to defend ourselves vigorously,” an Optum spokesperson told a Becker’s in an emailed statement.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
