“A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.” UnitedHealth Chief Executive Andrew Witty told CNBC Monday.

The disclosure suggests patients’ healthcare information remains vulnerable. An initial review of the compromised data showed files with protected health information or personally identifiable information “which could cover a substantial proportion of people in America,” the company said in a statement on it’s website.

“This attack was conducted by malicious threat actors, and we continue to work with the Law Enforcement and multiple leading cybersecurity firms during our investigation.”

They did not say exactly how many people’s data was stolen, but that it was monitoring where hackers tend to leak or trade such packets.