On Aug. 12, 2025, UnitedHealthcare disclosed a data breach to the U.S. Department of Health and Human Services, reporting that the incident affected at least 3,215 people in the United States.
According to the disclosure, the cybersecurity incident compromised both personally identifiable information (PII) and protected health information (PHI). Exposed information may include names, addresses, Social Security numbers, driver's license and state ID numbers, health insurance details and medical records.
The breach has the potential to put affected individuals at risk for identity theft and fraud, as both PII and PHI are highly sought after by cybercriminals.
In addition to the Health and Human Services disclosure, UnitedHealthcare will work to identify and notify affected individuals with the data breach details.
If you believe your personal and protected health information may have been compromised in this breach:
More information about UnitedHealthcare can be found on their official website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.