Change managers discovered the ransomware attack in February 2024. The attack and the response to the attack locked up much of the U.S. health care communications network for weeks and led to serious cash-flow problems for some health care providers.

Change acknowledged in April 2024 that the attack could have affected the protected health information of a "substantial proportion of people in America." It gives that same description of the scope impact in the web-based version of its official data breach notice.

Related: UnitedHealth's Change Healthcare unit begins sending breach notices

Change is offering two years of free credit monitoring and identity theft protection services to the affected people.

The business has been mailing breach notice letters in waves. The first wave of letters went out June 20, 2024, and the most recent went out Dec. 4, 2024.

Change "does not anticipate that it will identify any additional customers" who need notices, the firm says.

For many customers, the attack affected health insurance information, medical records, and information about medical bills and payments.

"For the majority of potentially affected individuals, Social Security numbers were not impacted, and, except in rare instances, financial and banking information, payment cards, driver's licenses or state ID numbers, or other ID numbers were not involved," Change says.

A federal court in Minnesota is overseeing the wave of lawsuits triggered by the breach announcement. At this point, a judge has organized a health care provider lawsuit track for the "multidistrict litigation" proceedings and a patient lawsuit track.

Health insurers and self-funded health plans do not appear to have cases consolidated into the multidistrict litigation proceedings.