Allied World Insurance Company has gone to federal court to recover more than $1 million it paid out after the 2024 ransomware attack on Change Healthcare.
The complaint, filed May 14, 2026 in the District of Minnesota, is a subrogation play - the carrier steps into its insured's shoes and chases the vendor that allegedly caused the loss. Allied World insured Avatar Holdings LLC d/b/a Avesis, based in Tempe, Arizona, which the filing says "provided dental insurance and related services to its customers."
Under a Business Services Payer Agreement, the complaint says Change Healthcare handled a stack of essential plumbing for Avesis: printing and mailing documents such as Provider Termination Letters, Invoices, Member ID Cards, Medicare Denial Notices, Explanations of Benefits, and Utilization Management Letters. It also printed and mailed checks to providers, and ran an electronic claims clearinghouse moving claims and payments between providers and Avesis.
Then came February 21, 2024.
Allied World calls it an "entirely foreseeable and preventable ransomware incident." Citing congressional testimony from people affiliated with Change Healthcare, the filing describes how it started: the username and password of a low-level customer support employee, used to access the company's Citrix portal, ended up posted in a Telegram group chat that advertises stolen credentials.
The account was basic, the complaint says. But it had the authority to create accounts with administrative privileges, and it was not protected by multi-factor authentication. The filing alleges threat actors used the credentials to infiltrate large parts of Change Healthcare's systems unnoticed, exfiltrated terabytes of data, and demanded a ransom.
When the ransomware was discovered, the complaint says, Change Healthcare and its affiliates "intentionally made the applications and services it provided to its customers inoperable" and announced the incident publicly. Services to Avesis stopped "suddenly and without warning," the filing says, for varying periods of time.
Avesis had to retain alternate vendors or take services in-house "at its own increased expense," the complaint says, plus pay for additional internal labor and the resources needed to run those services. The total: over $1,000,000. Avesis put in a claim, Allied World paid it, and Allied World is now subrogated to its insured's rights.
The single count is breach of contract. Allied World alleges Change Healthcare broke its promise to deliver the contracted services and "intentionally stopped providing such services, or was compelled to stop providing such services as a result of its own gross negligence, recklessness, and willful misconduct in the securing of their own computer systems."
The complaint also alleges Change Healthcare did not follow the Agreement's provisions on suspension or termination before pulling services, failed to provide contracted-for remedies, and failed to maintain adequate safeguards required across multiple parts of the Agreement, including a Business Associate Agreement.
Allied World is asking for judgment in excess of $1,000,000, plus costs and attorney fees.
The case sits within MDL 3108, the Minnesota MDL centralizing claims tied to the Change Healthcare incident. The complaint says Change Healthcare's services reached "large portions of the entire healthcare industry."
The allegations have not been tested in court. Change Healthcare has not yet filed a response, and no court has ruled.
