One surprising thing is that the only state to sue Change/United is Nebraska. Where are the states that typically go further in protecting consumers, like California? Shouldn’t they be fining them for gross misconduct? I can’t think of something more negligent than leaking 100 million patients’ medical records due to a lack of two factor authentication.