AG Hilgers sues Change Healthcare over breach, says 575,000 Nebraskans had data stolen

LINCOLN, Neb. (KLKN) — Nebraska Attorney General Mike Hilgers sued a health care technology company on Monday over a massive data breach.

The lawsuit alleges that Change Healthcare, which processes prescriptions and insurance claims, had outdated cybersecurity systems.

Hilgers also said Change took more than a week to detect the breach and several months to notify consumers.

The breach began on Feb. 11, according to the attorney general’s office, when a low-level employee’s login credentials were posted on Telegram.

The next day, a hacker then used the username and password to access Change’s systems.

The breach went “undetected and unimpeded” for nine days, according to the lawsuit.

The hacker stole the personal information of tens of millions of people, including about 575,000 Nebraskans, the suit says.

Hilgers thinks the number of affected Nebraskans could actually be higher.

“This data breach is historic,” he said in a press release. “Not only because it compromised the most sensitive privacy and financial data of Nebraskans, but also because it shut down the payment and claim processing systems that form a significant part of the backbone of the medical payment processing industry,” he said in a press release. “Healthcare providers, including critical access hospitals in rural areas, have unfairly been forced to absorb financial pain, forcing major cash flow issues and, in some cases, delayed services.”

The attorney general also said Change did not start notifying Nebraskans who had their data stolen until almost five months after the breach was discovered.

The Nebraska Hospital Association said it was glad to see the lawsuit.

“On behalf of our 92 member hospitals and health systems, I would like to thank Attorney General Hilgers for his efforts to hod these companies accountable to their legal obligation to keep health information private,” said Jeremy Nordquist, president of the association.