Shareholder suit alleges UnitedHealth governance and cybersecurity failures preceded Change Healthcare cyberattack

A pair of shareholder groups has filed a lawsuit accusing UnitedHealth of ignoring governance and cybersecurity problems for years and, in doing so, misleading investors. The complaint links alleged oversight shortcomings to the events surrounding the Change Healthcare cyberattack, which exposed major operational and data risks in the health care payments and services ecosystem.

According to the lawsuit as described in a recent report, UnitedHealth allegedly failed to address cybersecurity gaps that were known or should have been known internally. The complaint also alleges that the company neglected broader governance responsibilities, framing the alleged lapses as systemic rather than isolated mistakes.

The suit further claims UnitedHealth shuttered an internal Medicare billing audit. Medicare billing audits are internal review processes used to identify and correct billing errors and compliance issues, and the complaint characterizes the move as part of a pattern of inadequate oversight. The report says the allegations include that these actions contributed to a misleading picture provided to investors.

A central element in the complaint is the chain of events that the groups say culminated in the Change Healthcare cyberattack. Change Healthcare is a critical health care technology and services provider in the payments and claims workflow, and attacks on such infrastructure can quickly ripple across providers, pharmacies, and insurers. The lawsuit argues that the cybersecurity weaknesses and governance gaps that preceded the incident were the sort the company should have elevated and mitigated earlier.

UnitedHealth, which reports health insurance and health services operations across the United States, is a major player in the Medicare and health care services markets. In this context, governance and cybersecurity are not only compliance issues but also operational risk factors. When large systems that support billing, claims processing, and data exchange fail, disruption can become enterprise-wide and affect downstream partners.

The report also describes the lawsuit as alleging investor-related conduct, including that UnitedHealth misled investors about the state of governance and cybersecurity. In such cases, shareholder complaints typically argue that management disclosures did not reflect the extent of control failures or risk exposure that plaintiffs say existed at the time.

What remains unclear from the publicly described allegations is the specific timeline of the alleged cybersecurity issues, which internal controls were purportedly deficient, and what corrective actions the company did or did not take before the Change Healthcare incident. The report likewise does not lay out the company’s response, any internal findings, or whether the Medicare billing audit shutdown followed a formal remediation plan.

For UnitedHealth, the next steps likely hinge on procedural developments in the case, including any motions to dismiss and the scope of factual discovery. The lawsuit’s focus on governance, cybersecurity oversight, and investor disclosures suggests that the litigation could concentrate on internal documentation about risk management and the adequacy of controls before the Change Healthcare cyberattack.