Iowa Sues Change Healthcare Over Breach Affecting 2.2M Residents

Iowa Attorney General Brenna Bird has filed a lawsuit against Change Healthcare, alleging the company violated state consumer protection and data security laws in connection with a 2024 data breach that affected nearly 2.2 million Iowa residents, according to a news release from the Iowa Attorney General’s office. Filed on 31 March, the lawsuit claims the breach exposed sensitive personal and medical information and caused widespread disruption across Iowa’s healthcare system.

The breach began on 11 February 2024 and went undetected for 10 days, during which a hacker gained access to Change Healthcare’s systems, created administrator accounts, installed malware and exfiltrated data. The compromised information included Social Security numbers, driver’s licence numbers, insurance details, medical records and billing information. Iowa is only the second state to sue Change Healthcare over the incident.