Cyber Incident Victim: United Healthcare

United HealthCare (UHC) detected suspicious activity targeting its mobile application between February 19 and February 25, 2023, which potentially exposed personal information of enrolled members. The incident was identified through an internal investigation prompted by anomalous behavior observed on the platform. On April 10, 2023, UHC concluded that unauthorized parties had accessed member data during that seven-day window. The intrusion was attributed to a credential stuffing attack, where malicious actors used previously compromised usernames and passwords from unrelated sources to infiltrate user accounts. UHC emphasized that the attackers did not obtain login credentials directly from its own systems. Upon discovering the breach, the company immediately locked affected portal accounts and executed forced password resets to prevent further unauthorized access. The mobile application itself was confirmed as the primary vector of the attack, though no additional system compromises were identified. UHC maintained that its security protocols were not breached, attributing the incident to external credential misuse. The delayed public disclosure occurred on April 28, 2023, when impacted members began receiving mailed notifications.

Compromised data included members’ first and last names, health insurance identification numbers, dates of birth, physical addresses, dates of medical service, treating provider names, claim details, and insurance group names and numbers. UHC explicitly confirmed that Social Security numbers and driver’s license information remained unaffected. The company initiated direct mail correspondence to impacted individuals starting April 28, offering two years of complimentary identity theft protection services as a precautionary measure. Affected members were directed to contact a dedicated phone line for further inquiries. UHC stated that containment measures were implemented swiftly after identifying the incident, though the two-month gap between discovery and notification allowed for thorough impact assessment. No operational disruptions to healthcare services or claims processing were reported. The organization publicly expressed regret for the incident and acknowledged potential customer concerns but did not quantify the number of affected individuals or specify geographic concentrations in its initial disclosure.