UnitedHealth Says Change Healthcare Hack Affects Over 100 Million (techcrunch.com) 23
UnitedHealth Group said a ransomware attack in February resulted in more than 100 million individuals having their private health information stolen. The U.S. Department of Health and Human Services first reported the figure on Thursday. TechCrunch reports: The ransomware attack and data breach at Change Healthcare stands as the largest known digital theft of U.S. medical records, and one of the biggest data breaches in living history. The ramifications for the millions of Americans whose private medical information was irretrievably stolen are likely to be life lasting. UHG began notifying affected individuals in late July, which continued through October. The stolen data varies by individual, but Change previously confirmed that it includes personal information, such as names and addresses, dates of birth, phone numbers and email addresses, and government identity documents, including Social Security numbers, driver's license numbers, and passport numbers. The stolen health data includes diagnoses, medications, test results, imaging and care and treatment plans, and health insurance information -- as well as financial and banking information found in claims and payment data taken by the criminals.
The cyberattack became public on February 21 when Change Healthcare pulled much of its network offline to contain the intruders, causing immediate outages across the U.S. healthcare sector that relied on Change for handling patient insurance and billing. UHG attributed the cyberattack to ALPHV/BlackCat, a Russian-speaking ransomware and extortion gang, which later took credit for the cyberattack. The ransomware gang's leaders later vanished after absconding with a $22 million ransom paid by the health insurance giant, stiffing the group's contractors who carried out the hacking of Change Healthcare out of their new financial windfall. The contractors took the data they stole from Change Healthcare and formed a new group, which extorted a second ransom from UHG, while publishing a portion of the stolen files online in the process to prove their threat.
There is no evidence that the cybercriminals subsequently deleted the data. Other extortion gangs, including LockBit, have been shown to hoard stolen data, even after the victim pays and the criminals claim to have deleted the data. In paying the ransom, Change obtained a copy of the stolen dataset, allowing the company to identify and notify the affected individuals whose information was found in the data. Efforts by the U.S. government to catch the hackers behind ALPHV/BlackCat, one of the most prolific ransomware gangs today, have so far failed. The gang bounced back following a takedown operation in 2023 to seize the gang's dark web leak site. Months after the Change Healthcare breach, the U.S. State Department upped its reward for information on the whereabouts of the ALPHV/BlackCat cybercriminals to $10 million.
The cyberattack became public on February 21 when Change Healthcare pulled much of its network offline to contain the intruders, causing immediate outages across the U.S. healthcare sector that relied on Change for handling patient insurance and billing. UHG attributed the cyberattack to ALPHV/BlackCat, a Russian-speaking ransomware and extortion gang, which later took credit for the cyberattack. The ransomware gang's leaders later vanished after absconding with a $22 million ransom paid by the health insurance giant, stiffing the group's contractors who carried out the hacking of Change Healthcare out of their new financial windfall. The contractors took the data they stole from Change Healthcare and formed a new group, which extorted a second ransom from UHG, while publishing a portion of the stolen files online in the process to prove their threat.
There is no evidence that the cybercriminals subsequently deleted the data. Other extortion gangs, including LockBit, have been shown to hoard stolen data, even after the victim pays and the criminals claim to have deleted the data. In paying the ransom, Change obtained a copy of the stolen dataset, allowing the company to identify and notify the affected individuals whose information was found in the data. Efforts by the U.S. government to catch the hackers behind ALPHV/BlackCat, one of the most prolific ransomware gangs today, have so far failed. The gang bounced back following a takedown operation in 2023 to seize the gang's dark web leak site. Months after the Change Healthcare breach, the U.S. State Department upped its reward for information on the whereabouts of the ALPHV/BlackCat cybercriminals to $10 million.
What has not been hacked yet? (Score:2)
Re: (Score:1)
Computer security is a joke.
The primary entry point for virtually ALL these "hacks" has been the idiot user engaging with the threat actor/s.
There is no software solution for idiots but I would welcome your superior solution based on your obviously extensive, detailed, knowledge in this space.
That being said, one unsecured account to rule them all is ... shockingly bad behaviour.... Sounds like their support engineers decided they didn't want to deal with PIM/PAM/etc.
Re: What has not been hacked yet? (Score:1)
Re: (Score:2)
Time to change the metrics.
I the CEO's get bonus on how much in sales. Sales goes up. Change it to how secure the information they hold.The security will go up.
Wells fargo already showed this. They told their employees that number of new open accounts establishes their bonus. So everyone opened up accounts illegally to up their numbers.
If they face prison time for breaches, The holes will be filled. They will weed out the people falling for social engineering. They will implement in depth protection within
Jail (Score:3)
First, they got hacked. For a company holding critical data, that's bad enough. But then they paid ransom , which the criminals just took and ran off with. So they have encouraged and funded future ransomware attacks.
Criminal charges. Board, CEO, CIO, all the way down the line. Whoever decided not to invest in security, and especially whoever decided to pay the ransom.
Re: (Score:2)
As usual (Score:1)
Our weekly (daily?) story about private industry doing it better than government. Next we'll have to suffer through the typical jargon of, "We take your privacy seriously", followed by the CEO getting a big reward for handling the situation as best he could under the circumstances. Needless to say, no one will be held accountable for any part of this.
Re: (Score:3)
A case of critical punctuation.
"We take your privacy, seriously."
This is why we can't have nice things. (Score:3)
Come on, guys. Extortion only works if you release your leverage when paid. If you don't hold up your end of the bargain, you ruin it for all those well-intentioned blackmailers. Is that the world you want to live in? One where hacking skills, time, and effort no longer add up to a living wage?
Sad. Sad, and self centered.
Got letter 2 weeks ago,my info hacked for 4th time (Score:3)
Re: (Score:2)
Re: (Score:3)
Yea, I got hacked also. I started the free credit monitoring service offered from UnitedHealth and Change Healthcare via IDX Services but No way. Strike 1: I go to their web site to register but it said the II had to disable my add blocker. Not going to do that. So I call the 1 888 number. I give some information to support and the send me a email link to finish the account setup process. They were very insistent that I check my spam folder and sure enough the email they sent went directly to spam, Strike 2
Paying for the witch-hunt (Score:2)
Whose taxes are paying for the witch-hunt caused by UHG doing a shitty job? Until the US loses the 'too big to jail' meme, and and 'do whatever it takes' (to make a profit) meme, ordinary tax-payers will be over a proverbial barrel for all the costs and inconvenience.
Make it a crime (Score:3)
I know hacking in and stealing data is a crime. But make CEOs personally criminally liable for this sort of thing and we would start seeing changes.
My 10-year-old son got a letter in the mail from Charge Healthcare about stolen data! Our kids aren't even safe any more.
Jfc stop paying the ransoms! (Score:5, Insightful)
You got hacked, got it. These are criminals. They are not men of honor. If you pay them off they will still sell the data.
It should be a serious crime to pay them off. Like felony jail time for CEO. As long as they keep getting paid they'll keep attacking. If they never got a penny then most of this would stop because there'd be no incentive. There'd still be some attacks for pure maliciousness but far fewer overall.
Re: (Score:2)
You got hacked, got it. These are criminals. They are not men of honor. If you pay them off they will still sell the data.
It should be a serious crime to pay them off. Like felony jail time for CEO. As long as they keep getting paid they'll keep attacking. If they never got a penny then most of this would stop because there'd be no incentive. There'd still be some attacks for pure maliciousness but far fewer overall.
You know, I'm a person who enjoys theorizing on why people behave, on the surface, in completely irrational and stupendously stupid ways. What I've come up with where it comes to these ransom demands is this:
C-Suites and Boards of Directors have one thing that they all understand: The need to make bank. When they get these demands after a hack, they don't see criminals. Because if they saw criminality in someone demanding money for nothing, especially in the health insurance racket, they would never, ever b
NOOO! (Score:1)
I have UnitedHealth! Now the hackers are going to tell everyone I have leprosy and then it's right back to the leper colony for me!
Might as well say it again (Score:3)
Massive leaks of "regular folks" private information will continue until the actual human beings at the top of the companies responsible are sentenced to lengthy prison sentences, and the companies fined so heavily that it can't be written off as just the cost of doing business.
It's not a big leap to imagine companies obtaining people's medical records and using them in any number of ways.