Hackers acquired health and personal information about a potentially "substantial proportion" of consumers during the massive Change Healthcare cyberattack, parent company UnitedHealth Group said on Monday.

Hackers usually seek sensitive data such as patient records, medical histories or treatment plans for use in further criminal acts or ransom demands in such breaches. UnitedHealth acknowledged for the first time that it paid ransom in attempt to stop the disclosure of stolen data.

"A ransom was paid as part of the company's commitment to do all it could to protect patient data from disclosure," CEO Andrew Witty told CNBC. "This attack was conducted by malicious threat actors, and we continue to work with the law enforcement and multiple leading cybersecurity firms during our investigation."