- Nebraska AG Mike Hilgers filed a lawsuit against Change Healthcare Inc. and its owners and operators (collectively, “Change”)—which provide a data clearinghouse used by healthcare providers, pharmacies, and insurers—alleging that the company’s data security and other operational failures in connection with a February 2024 cyberattack violated state consumer protection laws.
- The complaint alleges that Change’s systemic failures made it vulnerable to the cyberattack, which impacted 100 million Americans, and that its inadequate response exacerbated the data breach and led to a lengthy disconnection of Change’s platform services, halting critical healthcare services across the state.
- The lawsuit seeks declaratory and injunctive relief, civil penalties, restitution, costs and fees, among other relief.
- As previously reported, a multistate coalition of 17 Democratic and 5 Republican AGs wrote a letter urging Change’s parent company to take immediate steps to protect health care infrastructure and inform anyone whose data was compromised of the steps to mitigate future identity theft or systems risks.