Attorney General Mike Hilgers filed a major lawsuit in Lancaster County District Court against Change Healthcare alleging
violations of Nebraska’s Consumer Protection and Data Security Laws.
The complaint stems from a catastrophic data breach and subsequent operational shutdown that exposed the personal and electronic
protected health information of what the Attorney General’s Office believes to be at least hundreds of thousands of Nebraskans,
if not over a million. The data stolen includes some of the most sensitive information about a person, including information reflecting medical
diagnoses. The shutdown also disrupted critical healthcare services across the state.
The Change Healthcare data breach began on February 11, 2024, when the username and password of a low-level customer support
employee were posted in a Telegram group
chat notorious for selling stolen credentials.
The stolen data included Social Security numbers, driver’s license numbers, health insurance information, medical records,
billing details, and more.
The breach caused widespread disruption to Nebraska’s healthcare system, particularly affecting rural hospitals and critical
access facilities operating on already thin margins.
