Data mining and document review

Data mining, or document review, is the work of opening the files stolen in an intrusion to extract personal data and build the list of people to notify. In February 2024, Change Healthcare, a UnitedHealth subsidiary, was hit by ransomware preceded by large-scale exfiltration. In October 2024, the group reported about 100 million affected individuals to the Office for Civil Rights at the U.S. Department of Health and Human Services; in January 2025 it put the figure at about 190 million, and the number filed on July 31, 2025 reached 192.7 million. Between those dates, someone had to open the stolen files. Once forensics has established what left the network, a specialist vendor rebuilds the stolen set, dedupes it, runs it through detection tools (names, Social Security numbers, bank account numbers, health data). Human reviewers then decide the ambiguous documents and build the list of people to notify, with their addresses and the categories of data involved. That list feeds the notifications under Articles 33 and 34 of Regulation (EU) 2016/679, or under U.S. state breach laws. Double extortion makes the exercise close to routine: the leak site posts a sample, and the insured needs to know what is in it before reporters do. For the underwriter, the item sits under incident response costs or under notification costs depending on the wording, and the dividing line matters as soon as either one is sublimited. On a terabyte of office documents, the bill can exceed that of the technical investigation, because it is priced per document or per reviewer hour. The friction at claim time is proportionality. The carrier questions a full review where sampling would have done; the insured's counsel answers with the risk of under-notification before the regulator, which costs more than an over-broad review.