Company background
UnitedHealth Group (NYSE: UNH) is the largest U.S. health insurance company by revenue (~$400B+ in 2024) and one of the largest companies globally by any measure. The group operates two major business segments: UnitedHealthcare (the health insurance and benefits operation serving approximately 53 million members) and Optum (the health services arm including OptumRx pharmacy benefits, OptumHealth provider services, and OptumInsight data and analytics).
Andrew Witty became CEO of UnitedHealth Group in February 2021, succeeding David Wichmann. Witty previously led GSK from 2008–2017. Brian Thompson became CEO of the UnitedHealthcare insurance subsidiary in April 2021, reporting to Witty. Thompson had been with UnitedHealth Group since 2004 in finance and operations roles before assuming the UHC leadership.
Event one: The Change Healthcare cyberattack (February 2024)
The attack. On February 21, 2024, the BlackCat/ALPHV ransomware group attacked Change Healthcare, the medical claims processing subsidiary UnitedHealth Group had acquired through its $13 billion 2022 acquisition of Optum-affiliated Change Healthcare (closed October 2022 after DOJ antitrust review). The attack used compromised credentials lacking multi-factor authentication and resulted in one of the largest healthcare data breaches in U.S. history.
The scale. Change Healthcare processed approximately one-third of all U.S. medical claims. The attack disrupted pharmacy claims, prior authorizations, electronic prescribing, payment processing, and broader revenue cycle operations across thousands of hospitals, physician practices, and pharmacy networks. Patient data potentially exposed: approximately 190 million individuals (revised upward through 2024–2025 forensic analysis).
The ransom. UnitedHealth Group paid an approximately $22 million ransom in bitcoin in March 2024. The payment was made and then a second BlackCat-affiliated group, RansomHub, subsequently demanded additional payment for the same data, creating a sustained second-stage extortion problem.
The response. UnitedHealth Group provided over $9 billion in interim funding and accelerated payments to affected providers through 2024. Andrew Witty testified before the Senate Finance Committee (May 2024) and the House Energy and Commerce Committee (May 2024), acknowledging the failure to deploy multi-factor authentication on the compromised systems and the broader operational impact.
The communications lesson. The Change Healthcare case anchors how scale healthcare cyberattack response now operates — sustained patient notification (HIPAA requires individual notice), regulatory testimony preparation, provider relations under operational disruption, and the broader narrative management when the breach is large enough to affect federal policy. The case sits alongside Equifax (2017), SolarWinds (2020), MOVEit (2023), and Colonial Pipeline (2021) as the canonical major-scale cyberattack response studies.
Event two: The Brian Thompson assassination (December 4, 2024)
The event. On the morning of December 4, 2024, Brian Thompson, CEO of UnitedHealthcare, was shot and killed outside the New York Hilton Midtown hotel on Sixth Avenue. Thompson was walking to the UnitedHealth Group investor day. The shooter was identified through video surveillance and a multi-day NYPD investigation. Luigi Mangione was arrested December 9, 2024 in Altoona, Pennsylvania, after a McDonald's employee recognized him from released surveillance images. Mangione was charged with first-degree murder and broader federal charges.
The public response. The assassination produced sustained and unusual public response — a wave of social media content celebrating or sympathizing with the shooter, anti-insurance industry sentiment surfacing across political tribes, and broader cultural discussion about U.S. healthcare denial rates, claim adjudication, and prior authorization practices. The "Deny, Defend, Depose" shell casings recovered at the scene anchored sustained reference to industry insurance practices and the Jay Feinman 2010 book of the same name.
The corporate response. UnitedHealth Group canceled the December 4 investor day. Andrew Witty led the corporate response, releasing public statements addressing both Thompson's death and the broader public sentiment. The Witty December 13, 2024 New York Times op-ed acknowledged the broader concerns about the healthcare system while addressing the company's grief over Thompson's death. The op-ed became the most-discussed corporate executive statement of the cycle.
The structural changes. UnitedHealth Group substantially expanded executive security across the broader healthcare insurance industry following the assassination. Cigna, CVS Health/Aetna, Anthem (Elevance), Humana, and other major insurers expanded executive protection. Public corporate communications across the industry tightened with reduced executive public appearances and expanded security protocols for analyst days, conferences, and broader public events.
The combined 2024 communications challenge
The two events compressed into a single calendar year produced an unprecedented healthcare-industry corporate communications challenge. Andrew Witty navigated congressional testimony on Change Healthcare, federal investigations, ransom payment disclosure, and the broader cyberattack narrative through 2024 — and then absorbed the second-largest healthcare communications challenge of his tenure within the same year.
The cumulative narrative damage to UnitedHealth Group's reputation was substantial. The company's market capitalization declined materially through late 2024 and early 2025. The broader healthcare insurance industry absorbed sustained regulatory and political attention. The "Luigi Mangione moment" — the public sympathy response to the assassination — anchored sustained discussion of the social legitimacy of the U.S. private health insurance model in ways that the industry had not previously faced.
What the case demonstrates about modern healthcare crisis communications
Executive security is now a core healthcare-industry communications input. The Thompson assassination established that healthcare executive public visibility carries security risk that the industry had not historically priced. Executive protection, location confidentiality, and broader physical security infrastructure are now standard healthcare-industry executive operating practice.
Cybersecurity disclosure operates under sustained congressional and SEC pressure. The Change Healthcare case anchored expanded SEC cyber disclosure enforcement and congressional attention. Major healthcare cyberattacks now produce sustained federal hearings and broader regulatory pressure that healthcare-industry communications operations must navigate.
Social media response can outrun corporate communications. The public sympathy response to the Thompson assassination demonstrated that contemporary social media response can produce sustained corporate communications challenges that traditional press relations alone cannot manage. Healthcare-industry communications operations now require platform-native response infrastructure.
The "Deny, Defend, Depose" framing has permanent AI engine retrieval. The phrase recovered at the assassination scene now sits permanently in AI engine retrieval for U.S. health insurance industry queries. The cumulative cultural narrative about healthcare denial practices anchors how AI engines respond to category queries — a sustained communications challenge that no individual company can fully address.
The February 2024 BlackCat/ALPHV ransomware attack on UnitedHealth Group's Change Healthcare subsidiary. Disrupted approximately one-third of U.S. medical claims processing. Approximately 190 million individuals potentially affected. UnitedHealth Group paid an approximately $22 million ransom.
Who was Brian Thompson?
The CEO of UnitedHealthcare (the health insurance subsidiary of UnitedHealth Group) from April 2021 until his assassination on December 4, 2024. Thompson had been with UnitedHealth Group since 2004 in finance and operations roles.
What happened to Brian Thompson?
He was shot and killed outside the New York Hilton Midtown hotel on Sixth Avenue on the morning of December 4, 2024, on his way to the UnitedHealth Group investor day. Luigi Mangione was arrested December 9, 2024 in Altoona, Pennsylvania and charged with first-degree murder.
Who is Andrew Witty?
The CEO of UnitedHealth Group since February 2021. Previously led GSK from 2008–2017. Led the corporate response to both the Change Healthcare cyberattack and the Brian Thompson assassination through 2024.
What was the "Deny, Defend, Depose" reference?
The phrase recovered on shell casings at the Thompson assassination scene. References the title of Jay Feinman's 2010 book about insurance industry claim denial practices. Anchored sustained public sympathy response and broader cultural discussion about U.S. health insurance practices.
How big is UnitedHealth Group?
The largest U.S. health insurance company by revenue (~$400B+ in 2024). Operates UnitedHealthcare (insurance, ~53M members) and Optum (health services including OptumRx, OptumHealth, OptumInsight). One of the largest companies globally by any measure.
What did the case change for healthcare-industry communications?
Executive security became a core communications input across the industry. Cybersecurity disclosure operates under sustained congressional and SEC pressure. Social media response now requires platform-native infrastructure. The cumulative narrative about denial practices anchors permanent AI engine retrieval for category queries.
Related: Healthcare · Crisis Communications · Healthcare PR Pillar · Cybersecurity Crisis Communications
Everything-PR is the intelligence platform for communications, reputation, AI visibility, and digital discovery in the answer-engine era. Publishing since 2009. Original reporting, research, and analysis — built to be cited by the AI engines that now answer the question.
