MedicareCompareUSA Data Breach Affects PII & PHI

Published

August 11, 2025

Updated

August 11, 2025

MedicareCompareUSA Data Breach Affects PII & PHI

MedicareCompareUSA on behalf of United Healthcare

Types of INFORMATION affected

Names
Social Security Numbers
Dates of Birth
Addresses
Government IDs
Medical Info
Financial Info

In November 2024, MedicareCompareUSA, acting on behalf of United Healthcare, discovered suspicious activity affecting certain email accounts. An investigation determined that unauthorized access to these email accounts occurred between Nov. 5 and Nov. 21, 2024.

MedicareCompareUSA notified United Healthcare on March 18, 2025, that individuals connected to United Healthcare may have been impacted. The data breach compromised both personal and protected health information of individuals with multiple major health insurance companies.

Exposed information may include names, Social Security numbers, dates of birth, health insurance policy numbers, Medicaid and Medicare numbers. MedicareCompareUSA disclosed the cybersecurity incident to the Massachusetts and Washington Attorney Generals' offices on June 27, 2025.

Affected individuals were notified by mail beginning on June 27, 2025 and include at least 1,258 Washington residents and one Massachusetts resident.

MedicareCompareUSA and United Healthcare's response

In addition to required state and federal disclosures, MedicareCompareUSA is offering 12 free months of TransUnion Cyberscout single bureau credit monitoring services to affected individuals.

If you receive a notice from MedicareCompareUSA or your United Healthcare about this breach, you may want to:

Sign up for the free TransUnion Cyberscout credit monitoring services offered.
Monitor your credit reports and financial accounts for any unusual activity.
Be alert for phishing emails or phone calls that may use your exposed information.
Consider placing a fraud alert or credit freeze with major credit bureaus.

More information about the company can be found on the MedicareCompareUSA website.

Protect Your Data

A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.

This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.