UnitedHealthCare CEO Says 'Maybe a Third' of US Citizens Were Affected By Recent Hack

An anonymous reader shares a report: Two months after hackers broke into Change Healthcare systems stealing and then encrypting company data, it's still unclear how many Americans were impacted by the cyberattack. Last month, Andrew Witty, the CEO of Change Healthcare's parent company UnitedHealth Group, said that the stolen files include the personal health information of "a substantial proportion of people in America." On Wednesday, during a House hearing, when Witty was pushed to give a more definitive answer, testifying that the breach impacted "I think, maybe a third [of Americans] or somewhere of that level."

No Big Deal

[organgtool]

I'll just change my complete medical history to make whatever records they stole useless and irrelevant.

Re:

[flyingfsck]

Your privacy is important to us. Sigh

Why bother?

[TwistedGreen]

At this point just make all records public.

Re:

[thragnet]

"You have zero privacy anyway. Get over it." Scott McNealy, 1999

On the bright side

[Anonymous Coward]

Hopefully hackers will finally schedule me a prostate exam.

Re:

[wyHunter]

They're a pain in the *ss.

Re:

[flyingfsck]

If you hear the snap of a rubber glove - Run!

Re:

[wyHunter]

Exactly!

They took care of this

[Iamthecheese]

I'm completely sure United Healthcare has been punished [youtube.com] for this already. Aren't we supposed to be arguing red vs blue right now?

Re:

[jmccue]

If the government wasn't involved in health care, you wouldn't get these too big to fail monopolies

You actually believe this ? United Health is a Private Company. Based upon your comment, the the people you support, the GOP, are the ones which forced these private companies on medicare people. Also, if you were born before 1955, you do not use these companies but regular Medicare which the benefits for those people are better than what these forced upon us private companies offer.

Re: They took care of this

[guruevi]

Medicare wasnâ(TM)t a GOP policy, fixing it seems to always fall on the GOP and taking away benefits has always been a political poison pill regardless of whether it is actually affordable, so a middle ground is letting companies do Medicare but then you get these kinds of monstrosities that handle the information for virtually all citizens (because the governments need to track and forecast how many billions to pump into the system or else it will go broke).

If you like government run healthcare so muc

Re:

[Mirnotoriety]

> I'm completely sure United Healthcare has been punished [youtube.com] for this already. Aren't we supposed to be arguing red vs blue right now?

HAAAR! .. Makes you wonder if billg spend some of that $149B on security, we wouldn't be in this mess.

Trading places the board and csuite

[Ryanrule]

Watch this never happen again.

Re:

[usedtobestine]

Well, at 1/3 of the population, it can happen two more times.

Too big to fail

[dgatwood]

This is why no company should be allowed to grow so big that it has material private information on a third of the country.

When

[jmccue]

When do I get my 7 years of free Credit monitoring ? Now back to reality, I am anxiously waiting for my 1.15 USD settlement check while my info is on tor being sold for much more.

Re:When

[flyingfsck]

They offered 7 years of free prostate monitoring but nobody wanted to take them up on it.

Thank goodness I'm American.

[nightflameauto]

I gave up on the American medical system a decade or more ago. It's price gouges the shit out of everyone, even those that don't participate, by mandating insurance, which you must purchase from a for-profit company. Said company then gets final say over whether you need treatment, not your doctor. And they have the right to approve coverage, allow the procedure, then "change their mind" after the fact leaving you footing the bill. Fuck every last individual involved in that scam pile of bullshit.

Which brings me to my "bright side." I doubt I have any medical records worth losing. Yay for living in a third-world shithole country my entire life that never gave me the illusion that healthcare was something I had any right to have.

Re:

[alvinrod]

You don't need to own a car if you don't want to. Automotive insurance is only required if you own and operate a vehicle and not all forms of insurance are mandated. There are plenty of people who don't need to own a car and can use taxis on the odd occasion they would need one and public transport options aren't available.

Medical insurance (and the system as well) would probably work better if it was limited to expensive emergency care. Car insurance doesn't cover oil changes or other mundane maintenanc

Re:

[nightflameauto]

Medical insurance (and the system as well) would probably work better if it was limited to expensive emergency care. Car insurance doesn't cover oil changes or other mundane maintenance. I suspect that if more common medical services were removed from insurance it would result in a more competitive industry that's up front about costs to patients.

Yes, definitely. The right move is to make people pay for shit they already can't afford. I'm sure the insurance companies would just open right up if that happened, and stop being price gouging dicks.

And for the record, I've never had an issue with car insurance. Once you hit 26 and/or get married and/or both, it's cheap as shit for what you can get out of it. And, surprise, surprise, I've never had a car insurance company not pay out when you need them to. I have, on the other hand, in my earlier life, ha

Not to worry

[RogueWarrior65]

We'll just raise your premiums by another 30% this year.

Is anybody doing it right?

[newslash.formatblows]

As someone not in the computer security field, I can't help but notice there's a new massive leak about once a week or so, it seems. Is it impossible to keep data secure, or are these leaks just evidence of incompetence/mismanagement on the part of crappy companies? Are there companies doing it right that we just never hear about, or does it really happen to all of them eventually?

one company doing it right - stuffed toy make

[FeelGood314]

You can't measure good security. It's a cost to companies but they see no benefit to it. Change Healthcare took a chance and they lost but they won't lose much money and everyone else who has bad security but wasn't breached didn't lose anything at all. Most companies, (and most security experts) don't even understand where to start with security. You start by knowing all the things you need to protect. Most militaries can't even do that. So companies just rely on security in depth and play whack a mo

Re:

[SethJohnson]

Yes, there is a thing known as "security as a culture." Companies that practice it prioritize security as Job 1. From top-to-bottom everyone is regularly trained on security practices and auditing is performed by independent third parties to ensure policies are followed.

I work with a bunch of very large companies and a huge federal agency. It's easy to tell which organizations practice security as a culture and which ones are just on the waiting list for hackers-as-a-service to infiltrate and hold their d

Data like that needs to be a liability...

[alispguru]

... as well as an asset. How about:

* If you have data that can be use for identity theft, and it leaks, you owe a per-person-exposed fine.
* In the absence of reliable records, all unencrypted data held by the company is assumed to have leaked.
* Fines are increased if if can be shown the company knew about the leak for more than 30 days before admitting it publicly.

With something like this hanging over them, companies:
* Might think twice about keeping data they don't really need,
* Might encrypt data at rest to make it harder to steal.

corporations don't care

[jjbenz]

I just received a letter from AT&T the other day that my personal information may have been harvested in a data breach. This comes after my HMO was breached. At this point I think I might as well spray paint my ssn and other info on my garage door since that stuff gets out there no matter who has the info to begin with.