Data Breach Disrupts Healthcare Across Nebraska

Nebraska Attorney General Michael T. Hilgers has filed a lawsuit against Change Healthcare, its parent company UnitedHealth Group, and its operating entity Optum, following a data breach that exposed the sensitive personal and medical information of approximately 575,000 Nebraskans. Filed in Lancaster County District Court on Tuesday, the lawsuit accuses the companies of violating Nebraska’s consumer protection laws and failing to safeguard critical patient data.

The breach, described in court documents as a “preventable disaster,” impacted millions nationwide and brought key healthcare services to a standstill. Change Healthcare, a major processor of medical claims, saw its systems compromised in February 2024, leading to widespread delays in care and financial disruption. Hackers reportedly exploited low-level employee credentials to infiltrate the company’s network, exfiltrating terabytes of data before deploying ransomware that crippled operations. While UnitedHealth has labeled the lawsuit “without merit,” the fallout has severely impacted Nebraska’s healthcare infrastructure.

Alleged Security Lapses and Delayed Response

The lawsuit alleges that Change Healthcare failed to implement basic cybersecurity practices, which could have prevented the breach. Among the vulnerabilities cited are outdated systems, the absence of multi-factor authentication, and poor network segmentation that allowed hackers unrestricted access. Congressional testimony from UnitedHealth’s CEO acknowledged the company’s reliance on decades-old infrastructure and physical servers rather than more secure cloud-based solutions.

Equally concerning was the delayed notification to those affected. The breach began in February 2024, but notifications to individuals were not issued until late July—and only after the Attorney General requested an update. This delay allegedly violated Nebraska’s Financial Data Protection and Consumer Notification of Data Security Breach Act, which mandates timely disclosure. The lack of transparency, according to the complaint, hindered healthcare providers’ ability to address the crisis effectively.

Financial and Operational Strain on Healthcare Providers

The aftermath of the breach placed immense pressure on Nebraska’s healthcare providers, particularly rural hospitals operating on slim financial margins. Larger healthcare systems reportedly lost millions daily due to interrupted operations, while smaller facilities were forced to take out loans, liquidate assets, or rely on reserve funds to stay afloat. Patients experienced significant delays in care, prescription denials, and in some cases, fell victim to scams exploiting the chaos.

Nebraska’s 62 critical access hospitals were among the hardest hit. These facilities, crucial to rural communities, faced severe financial strain, struggling to maintain operations as claims processing systems remained offline for weeks. Additionally, healthcare providers incurred substantial costs transitioning to alternative claims processors, while delayed reimbursements caused further disruptions.

Legal Action and Industry Implications

The Attorney General’s lawsuit seeks civil penalties, restitution for affected residents, and injunctive measures to ensure future compliance with data protection standards. The filing underscores the defendants’ failure to safeguard some of the most sensitive information in the healthcare sector, calling for greater accountability in the face of widespread harm.

This legal battle has broader implications for how states address cybersecurity breaches in critical industries. With healthcare increasingly reliant on digital infrastructure, the case highlights the urgent need for robust security measures and corporate responsibility in protecting patient data. The outcome could serve as a pivotal moment in shaping policies around data security and breach accountability in the healthcare sector.