The crippling Change Healthcare cyberattack that brought pharmacies and clinics to a standstill earlier this year may have been preventable, according to explosive allegations in a new lawsuit. Two shareholder groups are suing parent company UnitedHealth Group (UHG), claiming the healthcare giant misled investors and consciously ignored critical cybersecurity vulnerabilities for years, ultimately leading to the breach.
The lawsuit, filed by Trilogy and the Sheet Metal Workers National Pension Fund, alleges that UHG’s board and executives were aware of the risks. It points to a 2021 report from a cybersecurity consultant—commissioned before UHG even acquired Change Healthcare—that flagged “numerous” security gaps. Despite these warnings, the suit claims UHG failed to properly integrate and secure Change’s IT systems after the purchase, leaving the door open for attackers.
The allegations extend beyond cybersecurity. The shareholders also claim that UHG leadership disbanded an internal team that was auditing its Medicare Advantage billing practices. This move, the suit suggests, was made to avoid uncovering potential overpayments, painting a broader picture of a company prioritizing profits over governance and security.
Why This Matters for Digital Health
The fallout from the Change Healthcare attack was a stark reminder of how interconnected our modern healthcare system is—and how vulnerable it can be. For patients and providers who rely on digital tools, this lawsuit raises critical questions about trust and security.
At Medicup, we believe security is not an optional extra; it is the foundation of digital healthcare. The disruption caused by the Change breach, from delayed prescriptions to paralyzed billing departments, underscores the immense responsibility platforms have to protect their infrastructure. When a single point of failure can impact care for millions, the stakes are too high for complacency.
This situation is a cautionary tale for the entire industry. Providers need to have confidence that their digital partners are vigilant about security, not just for data privacy, but for operational continuity. Patients deserve to know that the platforms handling their most sensitive information are built on a culture of security and transparency. As healthcare becomes increasingly digital, choosing partners who prioritize resilience and robust governance has never been more important.
Source: [Healthcare Dive](https://www.healthcaredive.com/news/investor-lawsuit-unitedhealth-ignored-governance-cybersecurity-gaps-change/828016/)