UnitedHealth Says Change Healthcare Hack Affects Over 100 Million

UnitedHealth Group said a ransomware attack in February resulted in more than 100 million individuals having their private health information stolen. The U.S. Department of Health and Human Services first reported the figure on Thursday. TechCrunch reports: The ransomware attack and data breach at Change Healthcare stands as the largest known digital theft of U.S. medical records, and one of the biggest data breaches in living history. The ramifications for the millions of Americans whose private medical information was irretrievably stolen are likely to be life lasting. UHG began notifying affected individuals in late July, which continued through October. The stolen data varies by individual, but Change previously confirmed that it includes personal information, such as names and addresses, dates of birth, phone numbers and email addresses, and government identity documents, including Social Security numbers, driver's license numbers, and passport numbers. The stolen health data includes diagnoses, medications, test results, imaging and care and treatment plans, and health insurance information -- as well as financial and banking information found in claims and payment data taken by the criminals.

The cyberattack became public on February 21 when Change Healthcare pulled much of its network offline to contain the intruders, causing immediate outages across the U.S. healthcare sector that relied on Change for handling patient insurance and billing. UHG attributed the cyberattack to ALPHV/BlackCat, a Russian-speaking ransomware and extortion gang, which later took credit for the cyberattack. The ransomware gang's leaders later vanished after absconding with a $22 million ransom paid by the health insurance giant, stiffing the group's contractors who carried out the hacking of Change Healthcare out of their new financial windfall. The contractors took the data they stole from Change Healthcare and formed a new group, which extorted a second ransom from UHG, while publishing a portion of the stolen files online in the process to prove their threat.

There is no evidence that the cybercriminals subsequently deleted the data. Other extortion gangs, including LockBit, have been shown to hoard stolen data, even after the victim pays and the criminals claim to have deleted the data. In paying the ransom, Change obtained a copy of the stolen dataset, allowing the company to identify and notify the affected individuals whose information was found in the data. Efforts by the U.S. government to catch the hackers behind ALPHV/BlackCat, one of the most prolific ransomware gangs today, have so far failed. The gang bounced back following a takedown operation in 2023 to seize the gang's dark web leak site. Months after the Change Healthcare breach, the U.S. State Department upped its reward for information on the whereabouts of the ALPHV/BlackCat cybercriminals to $10 million.

What has not been hacked yet?

[rapjr]

Anything? Who has not had multiple accounts compromised? Computer security is a joke.

Kamela Harris has a respense!

[Valgrus Thunderaxe]

In order to manage our equities, it becomes incumbent on us, as a people, to leverage our diversity and balance our synergies. Our strength lies in our ability to communicate responsiveness to changing social strata. Thus, I propose a Rust-based para-virtualized enterprise hypervisor solution which combines our strengths with post-modern idealism. In this hectic climate, our futurism will be manifested in our calling for social change. Government, much like the enterprise space, will transcend the front

Jail

[bradley13]

First, they got hacked. For a company holding critical data, that's bad enough. But then they paid ransom , which the criminals just took and ran off with. So they have encouraged and funded future ransomware attacks.

Criminal charges. Board, CEO, CIO, all the way down the line. Whoever decided not to invest in security, and especially whoever decided to pay the ransom.

Re:

[Woeful Countenance]

Even worse, they didn't get anything in return for paying the ransom, because the thieves kept the data anyway. Evidently these aren't honorable criminals. Then one stole all the money from the others. Just can't trust anybody.

As usual

[quonset]

Our weekly (daily?) story about private industry doing it better than government. Next we'll have to suffer through the typical jargon of, "We take your privacy seriously", followed by the CEO getting a big reward for handling the situation as best he could under the circumstances. Needless to say, no one will be held accountable for any part of this.

This is why we can't have nice things.

[Petersko]

Come on, guys. Extortion only works if you release your leverage when paid. If you don't hold up your end of the bargain, you ruin it for all those well-intentioned blackmailers. Is that the world you want to live in? One where hacking skills, time, and effort no longer add up to a living wage?

Sad. Sad, and self centered.