A ransomware assault earlier this 12 months on UnitedHealth-owned well being tech firm Change Healthcare doubtless stands as one of many largest knowledge breaches of U.S. well being and medical knowledge in historical past.
Months after the February knowledge breach, a “substantial proportion of people living in America” are receiving discover by mail that their private and well being info was stolen by cybercriminals in the course of the cyberattack on Change Healthcare. At the very least 100 million individuals are actually recognized to be affected by the breach.
Change Healthcare processes billing and insurance coverage for tons of of hundreds of hospitals, pharmacies and medical practices throughout the U.S. healthcare sector. As such, it collects and shops huge quantities of extremely delicate medical knowledge on sufferers in the USA. By way of a sequence of mergers and acquisitions, Change turned one of many largest processors of U.S. well being knowledge, dealing with between one-third and one-half of all U.S. well being transactions.
Right here’s what has occurred because the ransomware assault started.
February 21, 2024
First report of outages as safety incident emerges
It appeared like an strange Wednesday afternoon, till it wasn’t. The outage was sudden. On February 21, billing techniques at medical doctors workplaces and healthcare practices stopped working, and insurance coverage claims stopped processing. The standing web page on Change Healthcare’s web site was flooded with outage notifications affecting each a part of its enterprise, and later that day the corporate confirmed it was “experiencing a network interruption related to a cyber security issue.” Clearly one thing had gone very mistaken.
It seems that Change Healthcare invoked its safety protocols and shut down its complete community to isolate intruders it present in its techniques. That meant sudden and widespread outages throughout the healthcare sector that depends on a handful of firms — like Change Healthcare — to deal with healthcare insurance coverage and billing claims for huge swathes of the USA. It was later decided that the hackers initially broke into the corporate’s techniques over every week earlier, on or round February 12.
February 29, 2024
UnitedHealth confirms it was hit by ransomware gang
After initially (and incorrectly) attributing the intrusion to hackers working for a authorities or nation-state, UnitedHealth later stated on February 29 that the cyberattack was in reality the work of a ransomware gang. UnitedHealth stated the gang “represented itself to us as ALPHV/BlackCat,” an organization spokesperson advised TechCrunch on the time. A darkish internet leak website related to the ALPHV/BlackCat gang additionally took credit score for the assault, claiming to have stolen tens of millions of Individuals’ delicate well being and affected person info, giving the primary indication of what number of people this incident had affected.
ALPHV (aka BlackCat) is a recognized Russian-speaking ransomware-as-a-service gang. Its associates — contractors who work for the gang — break into sufferer networks and deploy malware developed by ALPHV/BlackCat’s leaders, who take a reduce of the earnings collected from the ransoms collected from victims to get their information again.
Understanding that the breach was attributable to a ransomware gang modified the equation of the assault from the type of hacking that governments do — generally to ship a message to a different authorities as a substitute of publishing tens of millions of individuals’s non-public info — to a breach attributable to financially motivated cybercriminals, who’re more likely to make use of a wholly completely different playbook to get their payday.
March 3-5, 2024
UnitedHealth pays a ransom of $22 million to hackers, who then disappear
In early March, the ALPHV ransomware gang vanished. The gang’s leak website on the darkish internet, which weeks earlier took credit score for the cyberattack, was changed with a seizure discover claiming that U.Okay. and U.S. legislation enforcement took down the gang’s website. However each the FBI and U.Okay. authorities denied taking down the ransomware gang as they’d tried months earlier. All indicators pointed to ALPHV working off with the ransom and pulling an “exit scam.”
In a posting, the ALPHV affiliate who carried out the hack on Change Healthcare claimed that the ALPHV management stole $22 million paid as a ransom and included a hyperlink to a single bitcoin transaction on March 3 as proof of their declare. However regardless of dropping their share of the ransom fee, the affiliate stated the stolen knowledge is “still with us.” UnitedHealth had paid a ransom to hackers who left the information behind and disappeared.
March 13, 2024
Widespread disruption throughout U.S. healthcare amid fears of information breach
In the meantime, weeks into the cyberattack, outages had been nonetheless ongoing with many unable to get their prescriptions crammed or having to pay money out of pocket. Navy medical insurance supplier TriCare stated “all military pharmacies worldwide” had been affected as effectively.
The American Medical Affiliation was saying there was little info from UnitedHealth and Change Healthcare concerning the ongoing outages, inflicting huge disruption that continued to ripple throughout the healthcare sector.
By March 13, Change Healthcare had acquired a “safe” copy of the stolen knowledge that it had simply days earlier paid $22 million for. This allowed Change to start the method of poring by way of the dataset to find out whose info was stolen within the cyberattack, with the goal of notifying as many affected people as attainable.
March 28, 2024
U.S. authorities ups its bounty to $10 million for info resulting in ALPHV seize
By late March, the U.S. authorities stated it was upping its bounty for info on key management of ALPHV/BlackCat and its associates.
By providing $10 million to anybody who can establish or find the people behind the gang, the U.S. authorities appeared to hope that one of many gang’s insiders would activate their former leaders. It additionally may very well be seen because the U.S. realizing the specter of having a big variety of Individuals’ well being info probably printed on-line.
April 15, 2024
Contractor kinds new ransom gang and publishes some stolen well being knowledge
After which there have been two — ransoms, that’s. By mid-April, the aggrieved affiliate arrange a brand new extortion racket known as RansomHub, and because it nonetheless had the information that it stole from Change Healthcare, it demanded a second ransom from UnitedHealth. In doing so, RansomHub printed a portion of the stolen information containing what seemed to be non-public and delicate affected person data as proof of their menace.
Ransomware gangs don’t simply encrypt information; in addition they steal as a lot knowledge as attainable and threaten to publish the information if a ransom isn’t paid. This is called “double extortion.” In some circumstances when the sufferer pays, the ransomware gang can extort the sufferer once more — or, in others, extort the sufferer’s clients, often known as “triple extortion.”
Now that UnitedHealth was keen to pay one ransom, there was a threat that the healthcare large could be extorted once more. It’s why legislation enforcement have lengthy advocated towards paying a ransom that permits criminals to revenue from cyberattacks.
April 22, 2024
UnitedHealth says ransomware hackers stole well being knowledge on a “substantial proportion of people in America”
For the primary time, UnitedHealth confirmed on April 22 — greater than two months after the ransomware assault started — that there was a knowledge breach and that it doubtless impacts a “substantial proportion of people in America,” with out saying what number of tens of millions of those that entails. UnitedHealth additionally confirmed it paid a ransom for the information however wouldn’t say what number of ransoms it finally paid.
The corporate stated that the stolen knowledge contains extremely delicate info, together with medical data and well being info, diagnoses, medicines, take a look at outcomes, imaging and care and therapy plans, and different private info.
Provided that Change Healthcare handles knowledge on about one-third of everybody residing in the USA, the information breach is more likely to have an effect on greater than 100 million individuals a minimum of. When reached by TechCrunch, a UnitedHealth spokesperson didn’t dispute the doubtless affected quantity however stated that the corporate’s knowledge evaluate was ongoing.
Could 1, 2024
UnitedHealth Group chief government testifies that Change wasn’t utilizing primary cybersecurity
Maybe unsurprisingly when your organization has had one of many greatest knowledge breaches in current historical past, its chief government is sure to get known as to testify earlier than lawmakers.
That’s what occurred with UnitedHealth Group (UHG) chief government Andrew Witty, who on Capitol Hill admitted that the hackers broke into Change Healthcare’s techniques utilizing a single set password on a consumer account not protected with multi-factor authentication, a primary safety characteristic that may stop password reuse assaults by requiring a second code despatched to that account holder’s cellphone.
One among the most important knowledge breaches in U.S. historical past was solely preventable, was the important thing message. Witty stated that the information breach was more likely to have an effect on about one-third of individuals residing in America — in step with the corporate’s earlier estimates that the breach impacts round as many individuals that Change Healthcare processes healthcare claims for.
June 20, 2024
UHG begins notifying affected hospitals and medical suppliers what knowledge was stolen
It took Change Healthcare till June 20 to start formally notifying affected people that their info was stolen, as legally required underneath a legislation generally often known as HIPAA, doubtless delayed partially by the sheer dimension of the stolen dataset.
The corporate printed a discover disclosing the information breach and stated that it might start notifying people it had recognized within the “safe” copy of the stolen knowledge. However Change stated it “cannot confirm exactly” what knowledge was stolen about every particular person and that the knowledge could fluctuate from individual to individual. Change says it was posting the discover on its web site, because it “may not have sufficient addresses for all affected individuals.”
The incident was so massive and sophisticated that the U.S. Division of Well being and Human Providers stepped in and stated that affected healthcare suppliers, whose sufferers are finally affected by the breach, can ask UnitedHealth to inform affected sufferers on their behalf, an effort seen at lessening the burden on smaller suppliers whose funds had been hit amid the continuing outage.
July 29, 2024
Change Healthcare begins notifying recognized affected people by letter
The well being tech large confirmed in late June that it might start notifying these whose healthcare knowledge was stolen in its ransomware assault on a rolling foundation. That course of started in late July.
The letters going out to affected people will probably come from Change Healthcare, if not the precise healthcare supplier affected by the hack at Change. The letter confirms what varieties of information was stolen, together with medical knowledge and medical insurance info, and claims and fee info, which Change stated contains monetary and banking info.
October 24, 2024
UnitedHealth confirms a minimum of 100 million individuals affected by knowledge breach
It took the medical insurance large greater than eight months to announce, but it surely has now confirmed that the information breach impacts greater than 100 million people. The variety of these affected is anticipated to rise, given some have acquired knowledge breach notifications as just lately as October. The U.S. Division of Well being and Human Providers reported the up to date quantity on its knowledge breach portal on October 24.
Because it stands, the information breach at Change Healthcare is now the biggest digital theft of U.S. medical data, and one of many greatest knowledge breaches in residing historical past.
