Nebraska Attorney General Mike Hilgers filed a lawsuit associated with the 2024 Change Healthcare data breach, which has been allowed to move forward after a motion to dismiss was rejected. The lawsuit filed in Lancaster County District Court in December 2024 named Optum, Change Healthcare, and UnitedHealth Group as defendants. The litigation asserted that the defendants committed a violation of Nebraska’s data privacy, consumer protection, and security regulations.
The complaint was filed after the disastrous ransomware attack and data breach that affected more than 190 million Americans, including about 900,000 Nebraskans. Following the ransomware attack, payment and claims processing systems were stopped for approximately two months, causing financial trouble for the healthcare organizations that depended on Change Healthcare’s clearinghouse services and slowing down important healthcare services for state residents.
The lawsuit alleged that the ransomware attack happened due to Change Healthcare’s failure to use reasonable and suitable cybersecurity procedures and adopt industry-standard cybersecurity procedures. The lawsuit also claimed that cybersecurity problems, because of poor network segmentation and prolonged use of obsolete IT systems, contributed to the enormity of the data breach and the inability to remedy the incident up to two months after the cyberattack. At this time, authorizations were discontinued for medical care and medications, delaying care, and patients were without necessary medications and prescriptions.
Additionally, the lawsuit questioned Change Healthcare’s response to the security breach, with Nebraskans having to wait for around five months before being notified that their sensitive data had been stolen in the attack. Due to the cyberattack, state locals were placed at substantial risk of harm because of fraud, identity theft, and other improper uses of their personal data and protected health information. Change Healthcare submitted a motion to dismiss; nevertheless, Lancaster County District Court Judge Susan Strong turned down the defendant’s arguments, finding that the state had sufficiently alleged all violations of the state’s customer safety and data privacy rules and permitting the lawsuit to continue to the following stage.
The state is seeking civil penalties, economic damages, compensation, and to entirely keep the defendants from engaging in acts and tactics that break state legislation. The Court’s decision makes certain they can keep on pursuing accountability and endorsing stronger security for Nebraskans’ medical data Attorney General Hilgers said that almost fifty percent of Nebraskans had their most sensitive information exposed because of this breach. The office is thankful the court allowed this action to continue, so we can carry on their fight to secure the privacy and rights of Nebraskans.