Nebraska’s lawsuit against Optum and Change Healthcare can move forward, judge rules
Nebraska’s lawsuit against UnitedHealth Group and its Optum and Change healthcare subsidiaries can move forward after a judge ruled against a motion to dismiss earlier this week.
The case, filed in December 2024 by Nebraska Attorney General Mike Hilgers, stems from the now-infamous breach of Change Healthcare’s network in February 2024, which effectively shut down medical reimbursement for much of the country and impacted a record-setting 200 million people.
In Nebraska alone, nearly 900,000 residents were affected, according to a statement from Hilgers’s office. The state was the first of the 50 to file a lawsuit against Change Healthcare, asking the courts to force the organization to implement better security and to be held accountable for its delay in notifying state residents that their data had been taken in the ransomware attack—something that took almost a full year in some cases to do.
In January 2025, Change Healthcare was still adding to its official tally on how many Americans were affected. The final figure ended up being nearly double initial estimates, which were thought to include roughly one-third of Americans.
That figure came from then-CEO of UnitedHealth, Andrew Witty, who gave that estimate during an April 2024 Senate hearing. The same day, he also revealed that a single legacy server that lacked multifactor authentication was the source of the breach.
Some portion of the stolen data, which contained the personal and medical information from pharmacies, clinics and hospitals all over the country, ended up for sale on the dark web.
Victims represent half of the state
Hilgers said “nearly half” of all Nebraskans had their personal data stolen—and much of it was sold for nefarious purposes online. He praised the court for allowing the state’s lawsuit to go forward.
“The court’s decision ensures we can continue pursuing accountability and promoting stronger protections for Nebraskans’ health information,” Hilgers said in a statement. “Nearly half of Nebraskans had their most sensitive information exposed because of this breach. Our office is grateful the Court allowed this action to proceed so we can continue our fight to protect the privacy and rights of Nebraskans.”
According to Hilgers, the case now enters the next phase of litigation, where he promised to pursue “all appropriate remedies under Nebraska law.”
The damages he is seeking have not been specified. With the dismissal now overruled, it remains to be seen if UnitedHealth will settle the case out of court.
The company also faces other lawsuits stemming from the Change Healthcare breach, many of which are still being consolidated and making their way through the federal court system.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.