A Nebraska court has allowed the state AG’s lawsuit against Change Healthcare to proceed, stemming from the February 2024 ALPHV/BlackCat ransomware attack that exposed health and personal data of an estimated 100 million individuals. The ruling signals that state attorneys general are prepared to pursue healthcare entities for inadequate cybersecurity controls, independent of federal enforcement. Organizations handling protected health information face escalating legal exposure at the state level, with executive accountability now a documented judicial concern.