Attorney General Brenna Bird announced she has filed a lawsuit against Change Healthcare for violations of Iowa’s Consumer Fraud Act and Personal Information Security Breach Protection Act, stemming from a large-scale data breach that affected nearly 2.2 million Iowans. The breach began on February 11, 2024, and was not discovered until February 21, 2024. For ten days, a criminal hacker navigated Change’s systems undetected, creating privileged administrator accounts, installing malware, and stealing sensitive data. The stolen data included Social Security numbers, driver’s license numbers, health insurance information, medical records, billing details, and more. When it finally recognized the breach, Change took its systems offline causing widespread disruption to Iowa’s healthcare system. Providers were forced to deliver care without receiving payment for insurance claims, while others incurred significant costs switching to a new claims processor. Patients faced delays in receiving medications and treatments. Change then delayed notifying affected Iowans, doing so only after five months.