Change Healthcare Data Breach Litigation: MDL 3108 Status

The Change Healthcare data breach litigation is centralized in MDL No. 3108 in the District of Minnesota before Judge Donovan W. Frank. The actions arise from a February 2024 ransomware attack on Change Healthcare, a healthcare data company, and they are brought by patients whose personal information was exposed and by providers whose claims processing was disrupted. The Judicial Panel on Multidistrict Litigation centralized the federal cases on June 7, 2024, and its October 1, 2026 statistics report lists 153 actions pending of 168 filed. On December 19, 2025, the court allowed the core negligence claims to proceed past the pleading stage. The documents reviewed for this article record no finding of liability, no certified class, no trial date and no settlement.

What the complaints describe

At the pleading stage a court takes the plaintiffs’ allegations as true, and the court’s December 19, 2025 opinions set out those allegations. Change Healthcare operates an electronic data interchange clearinghouse through which providers and payers exchange claims and payment information. The patient-action opinion describes the platform as the largest clearinghouse in the United States, processing approximately 15 billion healthcare transactions a year and representing over half of medical claims.

According to that opinion, the attackers gained access on February 12, 2024 by using the credentials of a low-level employee that the complaint says were found in a group chat used to sell stolen credentials. The portal did not use multi-factor authentication. The opinion states that the credentials let the attackers create administrator accounts, install malware and backdoors, and remain in the network undetected for nine days. On February 21, 2024, ALPHV deployed ransomware that blocked access to the network.

The opinion lists the data that the complaints say was taken: names, phone numbers, addresses, dates of birth, Social Security numbers, medical and dental records, payment and claims information, and insurance records. The patient complaint alleges that the personal information of over 190 million patients was stolen and that the incident was the largest healthcare data breach in the United States. The same opinion records the defendants’ most recent estimate, citing a March 14, 2025 Department of Health and Human Services frequently-asked-questions page, that approximately 192.7 million individuals were affected. It also recites the complaint’s allegation that UnitedHealth Group paid a $22 million ransom and that the data was posted on the dark web.

The opinion also describes the alleged security failures: no multi-factor authentication, unencrypted data, insufficient monitoring, no segmentation, and broader-than-necessary employee access. Those are allegations; the court decided only whether they were sufficient to proceed.

What is established vs. what is alleged

Established: the creation of MDL No. 3108 in the District of Minnesota on June 7, 2024 and the assignment to Judge Frank; the division of the litigation into patient and provider tracks with master complaints; the counts that the court allowed to proceed and the counts it dismissed on December 19, 2025; and the pending-case count in the Panel’s October 1, 2026 report.

Alleged, not decided: how the attackers obtained access; that they took the personal information of more than 190 million people; that a ransom was paid; that Change Healthcare’s security measures were deficient; that those deficiencies caused any patient’s or provider’s harm; and that the incident was the largest healthcare data breach in the country. The 192.7 million figure is the defendants’ estimate as the court recorded it, not an audited count, and the complaint alleges a different figure of over 190 million.

Where the claims stand procedurally

MDL No. 3108 is proceeding on the master docket 0:24-md-03108-DWF-DJF. Judge Donovan W. Frank sits in the District of Minnesota with Magistrate Judge Dulce J. Foster. The court has organized the litigation into patient and provider tracks, each with a master complaint (Doc. Nos. 406 and 407).

On December 19, 2025, the court ruled on both motions to dismiss. In the patient track it allowed claims for negligence (Count I) and negligence per se (Count II) to proceed, along with Minnesota consumer-protection and Minnesota Health Records Act claims for the Minnesota-based plaintiffs. It dismissed claims for third-party beneficiary breach of contract, unjust enrichment and declaratory judgment. For non-Minnesota patients, it reserved the state-law claims and directed home-state briefing.

In the provider track the court allowed negligence, breach of contract, breach of the TFAP Agreement, unjust enrichment, tortious interference with prospective economic advantage, negligent misrepresentation, fraudulent inducement, public nuisance under Minnesota law, and claims under the Minnesota, Florida, Illinois and New Jersey consumer-protection statutes to proceed. It dismissed negligence per se, breach of the implied covenant of good faith and fair dealing, and the declaratory judgment claim, and it terminated Optum Pay as a party. It reserved the same home-state questions for providers outside Minnesota.

The Panel’s October 1, 2026 report lists 153 actions pending of 168 filed. In the documents reviewed here, no class certified, no trial date set, and no settlement announced or approved.

Key dates

• February 12, 2024: attackers gain access to Change Healthcare’s network, according to the complaint as recited in the court’s December 19, 2025 opinion.
• February 21, 2024: ransomware is deployed, blocking access to the network (same opinion).
• June 7, 2024: the Judicial Panel on Multidistrict Litigation centralizes the federal actions as MDL No. 3108 in the District of Minnesota (court’s MDL page).
• December 19, 2025: the court rules on the patient and provider motions to dismiss, allowing some claims and dismissing others (District of Minnesota).
• October 1, 2026: the Panel’s statistics report lists 153 actions pending of 168 filed (JPML).

What this does not establish

The record reviewed here does not show that any court has found that the defendants caused any patient’s or provider’s harm, that the defendants were negligent, or that a particular security failure led to the theft of any person’s records. A ruling that a complaint states a claim is not a finding on the merits. The record does not show a certified class, a settlement, a trial date or a damages fund. The 192.7 million figure is an estimate recorded in the court’s opinion, not an audited count, and the complaints allege a different number. A data breach does not by itself establish that any person is entitled to compensation; that depends on the person’s facts and on which claims survive. Our guide to verifying settlement notices explains how to check a notice against a court record.

Frequently asked questions

Is the Change Healthcare litigation a class action?

The cases were filed as putative class actions, and the court’s December 2025 orders decide motions addressed to master complaints in the patient and provider tracks. No class has been certified in the documents reviewed here, so no one is a class member by virtue of a court order.

Has there been a settlement in the Change Healthcare litigation?

No settlement announcement or approval appears in the court orders and statistics reviewed for this article. The litigation remains in pretrial proceedings, with the home-state briefing described in the December 2025 orders outstanding.

How many people were affected by the Change Healthcare breach?

The patient complaint alleges that the personal information of over 190 million patients was stolen. The court’s December 19, 2025 opinion records the defendants’ most recent estimate, citing a March 14, 2025 Department of Health and Human Services page, that approximately 192.7 million individuals were affected. Both figures are allegations or estimates, not an audited count.

Does the breach mean I have a valid claim?

Whether any person can recover depends on facts specific to that person, including whether their information was exposed, what harm they can show, and which claims survive. The December 2025 orders allow some claims to proceed and dismiss others, which shows that the legal theory matters. This article is not legal advice, and anyone with questions about their own situation should consult a licensed attorney. See our explainer on MDL versus class action; the Class Actions category includes related coverage of the MOVEit data breach litigation and Roblox child safety claims.

Sources

1. United States Judicial Panel on Multidistrict Litigation: “MDL Statistics Report: Distribution of Pending MDL Dockets by District (Oct. 1, 2026)” (link, accessed 2026-10-17)
2. U.S. District Court for the District of Minnesota: “Change Healthcare, Inc. Customer Data Security Breach Litigation, MDL No. 3108” (link, accessed 2026-10-17)
3. U.S. District Court for the District of Minnesota: “Memorandum Opinion and Order, Individual Patient Actions (Dec. 19, 2025)” (link, accessed 2026-10-17)
4. U.S. District Court for the District of Minnesota: “Memorandum Opinion and Order, Provider Actions (Dec. 19, 2025)” (link, accessed 2026-10-17)

CollectiveClaim.us publishes general legal information. This article is not legal advice and does not create an attorney–client relationship. Court records and agency actions change; verify current status with the court or agency before relying on it.