Photo: BrianAJackson / iStock / Getty Images
(Iowa) -- Iowa's Attorney General is filing a lawsuit against Change Healthcare, accusing the company of violating the state's laws against consumer fraud and personal information security.
According to the lawsuit, a criminal hacker breached Change Healthcare's system in February of 2024 and was not detected for ten days, during which time the hacker stole data including social security numbers, medical records, and other sensitive information affecting nearly 2.2 million Iowans. Once the breach was detected, the company took its systems offline, leading to widespread service disruptions. The suit alleges the company waited until five months after the breach to notify affected Iowans.
The lawsuit identifies several deficient areas in Change Healthcare's system, including:
- Outdated IT systems
- Inadequate response to the breach
- Delays in notifying consumers of the breach
- Widespread operational disruptions
- Financial and operational burdens
- Significant harm to Iowa patients' sensitive data and information
The lawsuit argues the company's outdated system and response to the large-scale breach violated Iowa’s Consumer Fraud Act and Personal Information Security Breach Protection Act. The full text of the suit is available on the Iowa Attorney General's Office website.