UnitedHealth Board Faces Cybersecurity Suit

An amended shareholder complaint in Minnesota alleges that UnitedHealth Group directors ignored cybersecurity warnings and underfunded protections at Change Healthcare after its acquisition, contributing to the February 2024 ransomware attack.

The litigation links legacy systems, missing multifactor authentication, and governance decisions to the exposure of health and personal data belonging to approximately 190 million people, while seeking stronger controls and board-level remedies. The complaint also connects the cybersecurity allegations with broader disputes over Medicare compliance and automated care authorization.