US Court Orders Tight Security for Change Healthcare Data Stolen in Attack Affecting 193M
This digest was compiled by AI from multiple sources — links to the originals are below.
A federal judge has approved stringent security requirements for handling the stolen data of 193 million individuals that Change Healthcare must turn over in class action litigation over its 2024 cyberattack. The order, issued Friday by Magistrate Judge Dulce Foster in Minnesota, allows plaintiffs’ lawyers and their expert to examine the data under a tightly controlled, offline forensic environment.
Security Protocols
The protective order mandates that the defendants produce only a single encrypted copy of the complete stolen dataset on an external hard drive compliant with FIPS 140-2 or 140-3 standards. The plaintiffs’ expert must further encrypt the data using AES-256 or equivalent, and it must remain in an air-gapped, hardened environment with physical controls, chain-of-custody logs, and mandatory breach reporting. The order also requires destruction of the data after litigation, aiming to prevent any secondary exposure of protected health information and personally identifiable information.
Litigation Background
The multidistrict litigation consolidates more than 150 class action lawsuits accusing UnitedHealth Group subsidiaries, including Change Healthcare, Optum, and United HealthCare Services, of negligence, unjust enrichment, and consumer protection violations. The claims stem from the February 2024 ransomware attack by the BlackCat/Alphv gang, which disrupted Change Healthcare’s operations for months and compromised data on 193 million people. Magistrate Judge Dulce Foster approved the stipulated protective order on Friday, though a trial date has not been set in the U.S. District Court for Minnesota.
What's Next
The trial date remains unset, leaving the timeline for resolution uncertain. It remains unclear whether the stringent security measures will satisfy concerns over the potential re-exposure of highly sensitive health data.
1 source
US Court Orders Tight Security for Change Healthcare Data Stolen in Attack Affecting 193M
