In one of the largest healthcare data breaches in U.S. history, over 120 million Americans had their confidential health records and personal information stolen in a coordinated cyberattack targeting UnitedHealthcare.

According to court documents reviewed by Peoples Gazette, the breach occurred in February 2024, when hackers infiltrated UnitedHealthcare’s database, accessing over six terabytes of sensitive data. The stolen information includes names, addresses, email addresses, and Social Security numbers of registered clients.

The breach has led to a class-action lawsuit filed in the U.S. District Court for the District of Minnesota. Victims are demanding accountability for the security lapse that exposed their private health information.

The lawsuit, filed on January 15, 2025, revealed that the hacking began on February 21, 2024. While Russia-based cybercriminal group BlackCat is alleged to have orchestrated the initial attack, much of the stolen data was downloaded and distributed by Nigerian hackers. Additional downloads were traced to Russia and Brazil, underscoring the international scope of the breach.

“The stolen data quickly spread across five continents—North America, Asia, Europe, Africa, and South America,” the court filing states. “It was downloaded by 47 different entities, with significant activity originating from Nigeria and Russia.”


The hackers wasted no time distributing the stolen data across the dark web, fueling concerns about its misuse for identity theft and fraud. The lawsuit described the breach as a stark reminder of how quickly sensitive information can circulate globally once exposed.

At least 60 Americans have joined the lawsuit, detailing the devastating impact of the breach on their personal lives. Plaintiffs allege that the exposure of their private health data has caused significant emotional and financial harm.

The breach represents a major blow to trust in the healthcare industry’s ability to safeguard sensitive data. As the lawsuit unfolds, it raises urgent questions about cybersecurity practices and the responsibilities of corporations in protecting their customers.

This unprecedented breach highlights the growing threat of cyberattacks in a digital age, leaving millions to grapple with the consequences of stolen identities and compromised privacy.