UnitedHealth paid ransom after huge Change Healthcare cyberattack

The Russia-based cybercriminals who attacked a UnitedHealth Group-owned firm in February didn’t stroll away from the endeavor empty-handed. 

“A ransom was paid as a part of the corporate’s dedication to do all it might to guard affected person knowledge from disclosure,” a UnitedHealth Group spokesperson confirmed with CBS Information late Monday. 

The spokesperson didn’t disclose how a lot the well being big paid after the cyberattack, which shut down operations at hospitals and pharmacies for greater than per week. A number of media sources have reported that UnitedHealth paid $22 million within the type of bitcoin. 

“We all know this assault has induced concern and been disruptive for shoppers and suppliers and we’re dedicated to doing every little thing potential to assist and supply help to anybody who may have it,” UnitedHealth CEO Andrew Witty mentioned in a press release Monday.

UnitedHealth blamed the breach on a Russian ransomware gang generally known as ALPHV or BlackCat. The group itself claimed accountability for the assault, alleging it stole greater than six terabytes of knowledge, together with “delicate” medical data, from Change Healthcare, which processes medical insurance claims for sufferers who visited hospitals, medical facilities or pharmacies.

The dimensions of the assault — Change Healthcare processes 15 billion transactions a 12 months, in accordance with the American Hospital Affiliation —meant that even sufferers weren’t clients of UnitedHealth have been probably affected. The assault has already price UnitedHealth Group almost $900 million, firm officers mentioned in reporting first-quarter earnings final week.

Ransomware assaults, which contain disabling a goal’s laptop methods, have change into more and more frequent inside the well being care business. The annual variety of ransomware assaults in opposition to hospitals and different suppliers doubled from 2016 to 2021, in accordance with a 2022 research printed in JAMA Well being Discussion board.

The Change Healthcare incident was “straight out an assault on the U.S. well being system and designed to create most injury,”  Witty instructed analysts throughout an earnings name final week. In the end, the cyberattack is anticipated to price UnitedHealth between $1.3 billion and $1.6 billion this 12 months, the corporate projected in its earnings report.