UnitedHealthcare uhc.com UnitedHealthcare data breach 2025: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
HHS lists a case added in August 2025 in which a UnitedHealthcare employee mailed the health information of 3,215 people to the wrong recipients. The information involved demographic and treatment details.
View all 13,118 breaches- Breach date
- 12 Aug 2025
- Made public
- 12 Aug 2025
- Affected
- 3,215
- Data exposed
- Demographic information, Treatment information
- Last updated
What happened
UnitedHealthcare reported to the U.S. Department of Health and Human Services that an employee mailed the protected health information of 3,215 individuals to the wrong recipients. HHS's breach portal shows the case as added in August 2025. This was a mailing error, not a hack.
What was exposed
HHS's case description says the information involved demographic and treatment information. It doesn't list Social Security numbers or financial details.
What that lets criminals do
Treatment information is sensitive in itself, and demographic details such as name and address make it easy to write a convincing message about your care. The main risks are embarrassment, targeted phishing and, if insurance details were also included, medical identity theft. Since the mail went to the wrong recipients, the exposure depends on who opened it.
The response
According to HHS, UnitedHealthcare notified HHS, the affected individuals and the media, and added administrative safeguards.
What to watch for
If a letter from UnitedHealthcare arrives, it will say what your mailing contained. Keep it. If an explanation of benefits ever lists care you didn't receive, call the insurer and ask them to look into it.
Sources checked: ocrportal.hhs.gov
Last verified against the official page:
What to do if you were in it
- 1
Read your notice letter
UnitedHealthcare notified affected people. It explains what was in your mailing.
- 2
Check your explanation of benefits
Look for care or claims you don't recognize and report them to your insurer.
- 3
Expect phishing that mentions your care
Don't click links in texts or emails about claims or treatment. Call the number on your insurance card.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about it before a scammer uses it.
Official filings
- U.S. Department of Health and Human Services , filed 5 Jun 2026 : 37,384 people
- U.S. Department of Health and Human Services , filed 12 Aug 2025 : 3,215 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected?
UnitedHealthcare notified the affected people. HHS lists 3,215 individuals.
What was exposed?
Per HHS: demographic and treatment information.
Was this a hack?
No. HHS describes an employee mailing the information to the wrong recipients.
Sources
- U.S. Department of Health & Human Services · ocrportal.hhs.gov
Something wrong or out of date? Tell us and we'll re-check it.
