UnitedHealth shareholders sue company over ‘corporate governance failures on a historic scale’
Two major shareholders of UnitedHealth Group are suing the company and, in their complaint, accuse the Minnesota-based healthcare giant of negligence and malfeasance, including ignoring cybersecurity flaws and the deliberate manipulation of earnings, negatively impacting investors.
The plaintiffs in the case are the Swedish asset manager Länsförsäkringar Fondförvaltning AB and the Rhode Island state employee pension fund, that accuse the company of concealing its misconduct—including Medicare fraud—as part of an ongoing effort to deceive investors and the public.
Both investors also say the company bought back roughly $29 billion of its own shares to juice the price. The company’s stock is up almost 18% year-to-date, but is still down about 8% over the last five years. It currently stands at roughly $396.00 per share.
But the lawsuit isn’t all about the price of the stock; instead, it zooms in on allegations of misconduct that the institutional investors believe to be systemic. It accuses company executives and board members—both current and former—of “corporate governance failures on a historic scale.”
The legal complaint, initially filed in 2024, was updated on Aug. 7 with new information, specifically pertaining to the February 2024 data breach on Change Healthcare, a UnitedHealth subsidiary.
A historic cyberattack
When UnitedHealth purchased Change Healthcare in 2022—wrapping it under its Optum banner—the company allegedly put into place a literal and figurative “firewall” to limit data sharing between Optum and Change, in an effort to assuage the antitrust concerns of regulators. That was a claim made in the initial lawsuit.
However, the updated court filing no longer stands by that position. Instead, the plaintiffs cite a general lack of cybersecurity hygiene at Change Healthcare, backed by witnesses who say the historic hack that led to records on nearly 200 million Americans being exposed to cybercriminals was preventable.
Previously, UnitedHealth had admitted that a single server was the source of the data breach. That server, it confirmed, lacked multifactor authentication.
The lawsuit contends the incident was easily preventable, if not for an attempt by UnitedHealth to rush Change’s integration into the company, fearful of a looming U.S. Department of Justice (DOJ) challenge to the merger.
Instead of a firewall protocol, the lawsuit contends that Optum and Change Healthcare became so virtually intertwined that separating them was “nearly impossible.” In the end, this rushed integration led to unacceptable cybersecurity flaws, expert witnesses claim in the court filing.
No audits, no fraud
Another key part of the lawsuit is the allegation that UnitedHealth executives willfully engaged in Medicare fraud, allegedly shutting down an internal audit program meant to monitor billing to the federal healthcare program.
According to plaintiffs, the company has submitted at least $200 million worth of claims to the federal government, backed by erroneous diagnosis codes.
“[UnitedHealth] defrauded the federal Medicare program, denied medically necessary care to its most vulnerable members, deceived a federal court, violated patient privacy laws, unlawfully suppressed competition, and manipulated earnings,” the lawsuit reads.
The case is still pending in court.
HealthExec reached out to the company for comment.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.