Consumer Alert:
Attorney General James Urges New Yorkers to Use Free Credit Monitoring and Identity Theft Protection Services in Aftermath of Change Healthcare Cyberattack

Cyberattack on Change Healthcare’s Systems Affected Millions of Patients and Providers Nationwide

NEW YORK – New York Attorney General Letitia James today issued a consumer alert to raise awareness about free credit monitoring and identity theft protection services available for millions of consumers impacted by the Change Healthcare data breach. In February, Change Healthcare, which operates the nation’s largest electronic health care payment system, experienced a cyberattack that exposed the personal information of millions of patients, including millions of New Yorkers. After the cyberattack, Attorney General James urged UnitedHealth Group. Inc., the nation’s largest health insurer and the parent company of Change Healthcare, to bolster its efforts to protect providers, pharmacies, and patients harmed by the breach. Today, Change Healthcare is offering all New York residents free credit monitoring and identity theft protections for two years to safeguard their personal information.

“The disastrous cyberattack on Change Healthcare leaked the personal information of millions of Americans and made them vulnerable to bad actors,” said Attorney General James. “While UnitedHealth and its subsidiary work to address the fallout from the cyberattack, I urge everyone who believes their information may have been compromised to use the free credit monitoring and identity theft protection services to protect themselves. Companies should not treat strong data security as an afterthought, it is necessary to protect New Yorkers from fraud and my office will continue to ensure companies take this responsibility seriously.”

The cyberattack on Change Healthcare interrupted health care services at thousands of doctors’ offices, hospitals, and pharmacies and leaked Americans’ sensitive health and personal data onto the dark web, a hidden portion of the internet where cyber criminals can buy, sell, and track personal information. Change Healthcare estimates that the data breach could impact up to one-third of all Americans. 

Since Change Healthcare has not yet notified affected individuals, Attorney General James encourages everyone to use the free credit monitoring and identity theft protection services to safeguard their information. These resources will be available for free for two years. Consumers can enroll in free credit monitoring and identity protection services online or by calling 1-866-262-5342.

Consumers should be aware of potential warning signs that someone is using their medical information. These signs include: 

  • Bills for medical services they did not receive. 
  • Errors in their Explanation of Benefits statement, such as charges for services never received or prescriptions not taken.
  • Calls from debt collectors about medical debts they do not owe.
  • Medical debt collection notices on their credit report that they do not recognize.
  • Notices from their health insurance company about reaching benefit limits.
  • Denials of insurance coverage due to inaccurate pre-existing conditions.

If you are concerned about your data but prefer not to use the free services provided by Change Healthcare, consider freezing your credit by calling all three credit bureaus, Experian, Equifax, and TransUnion. A credit freeze prevents banks or lenders from accessing your credit report. This will stop identity thieves from taking out new loans or credit cards in consumers' names because creditors will not approve their loans or credit requests if they cannot first access their credit reports. By law, a credit bureau must allow consumers to place, temporarily lift, or remove a credit freeze for free.

When consumers freeze their credit with each bureau, the bureaus will send them a personal identification number (PIN). The consumers can then use that PIN to unfreeze their credit if they want to apply for a loan or credit card. Consumers can also use the PIN to freeze their credit again after they have applied for loans or a new credit card.

Consumers should call all three credit bureaus, Experian, Equifax, and TransUnion to freeze their credit.

Consumers can report concerns related to the Change Healthcare cyberattack to the Office of the Attorney General (OAG) by calling 1-800-771-7755 or filing a complaint online.