Episource, a medical billing behemoth, is informing millions of individuals across the United States that their personal and health information was seized in a cyberattack earlier this year.

According to a listing with the U.S. Department of Health and Human Services, the breach has impacted over 5.4 million individuals, making it one of the most significant healthcare breaches of the year thus far.

Episource, which is owned by UnitedHealth Group’s subsidiary Optum, offers accounting adjustment services to healthcare organizations, hospitals, and physicians.

As a result, the organization manages substantial quantities of patients’ confidential and medical information in order to effectively process claims through their health insurance.

Episource informed the states of California and Vermont on Friday that a criminal was able to “see and take copies” of patient and member data from its systems during the weeklong breach that concluded on February 6.

Personal information, including names, postal and email addresses, and phone numbers, as well as protected health data, including medical record numbers, and data related to physicians, diagnoses, medications, test results, imaging, care, and other treatment, has been stolen.

Health insurance information, including member numbers, policies, and health plans, is also included in the misappropriated data.

The nature of the incident was not disclosed by Episource; however, Sharp Healthcare, a company that collaborates with Episource and was impacted by the cyberattack, informed its customers that the Episource breach was the result of ransomware.

This is the most recent cybersecurity incident to affect UnitedHealth in recent years.

In February 2024, a ransomware gang compromised Change Healthcare, one of the largest companies in the U.S. healthcare industry that conducts billions of health transactions annually.

This incident resulted in the seizure of over 190 million Americans’ personal and health information.

The cyberattack was the most significant healthcare data exposure in the history of the United States.

Several months later, an assistant was able to access an internal chatbot that was utilized by employees to inquire about claims at UnitedHealth’s Optum unit.