A third of Americans may have had their personal data swept up in a February ransomware attack on a UnitedHealth Group subsidiary that disrupted pharmacies across the US, UnitedHealth CEO Andrew Witty estimated in testimony to Congress on Wednesday.

UnitedHealth Group Inc. Chief Executive Officer Andrew Witty told lawmakers his company is still trying to determine why its computer systems were left vulnerable to hackers who perpetrated a devastating cyberattack.

Multifactor, or two-step, authentication requires users to enter information, in addition to a username and password, to confirm the identity and authorization to access a particular service or software system.

Members of the U.S. military have had their data stolen in the recent cyberattack on UnitedHealth's technology unit that impacted almost all patients and providers, CEO Andrew Witty told the Senate Finance Committee on Wednesday.