Episource, a UnitedHealth subsidiary providing risk-adjustment and coding services, suffered a ransomware intrusion exposing data on approximately 5.4 million individuals.
The parent group had, the previous year, been at the centre of the Change Healthcare breach — the largest healthcare data compromise on record, affecting a figure north of 190 million.
Group Scale Does Not Transfer Downward
This desk filed the same structure at Envoy Air in 25-1017: a subsidiary runs its own estate, and the parent’s security programme does not automatically extend to it.
What makes this instance sharper is that the parent had every possible incentive to extend it. An organisation that has absorbed a nine-figure breach and the regulatory attention that followed is not short of motivation — it is short of reach into the subsidiaries it acquired.
Coding And Risk Adjustment Is Unusually Rich Data
Risk-adjustment services exist to establish how sick a covered population is, which requires diagnosis-level detail across a member base.
That is a more complete clinical picture than a provider holds for any individual patient, assembled specifically so it can be analysed. The business-associate concentration argument this desk filed at Conduent in 26-0731 applies with the sensitivity turned up.
Graded medium: the affected figure and the ransomware characterisation are consistently reported; the access route is not established.
Compiled from public reporting, listed below. The Change Healthcare comparison is context from prior public reporting, not a claim about a connection between the incidents. Corrections: corrections@forensicpost.com.