Change Healthcare data breach exposed ‘only’ 100 million US health records – Source: www.csoonline.com

Personal health information of 100 million individuals was stolen during the February ransomware attack on Change Healthcare, a unit of UnitedHealth, the US health department has revealed.

The cyberattack caused widespread disruption across the US healthcare sector, marking one of the largest known digital thefts of medical records to date.

The US Department of Health and Human Services (HHS) confirmed the staggering number of affected individuals, revealing the full scale of the breach for the first time on its website. In May, UnitedHealth CEO Andrew Witty testified before the House Energy and Commerce Committee that the personal data of potentially a third of US citizens, about 112 million people.

The health tech company got to know about the incident on February 21 and had earlier warned that a “substantial proportion of people in America” would be impacted by the breach.

“On March 7, 2024, CHC was able to confirm that a substantial quantity of data had been exfiltrated from its environment between February 17, 2024, and February 20, 2024,” Change Healthcare said in a statement in February.

The ransomware attack, attributed to the ALPHV/BlackCat ransomware group compromised personal information such as names, social security numbers, diagnoses, treatment plans, and financial data.

The attackers, ALPHV/BlackCat, a notorious Russian-speaking ransomware gang, initially absconded with $22 million paid in ransom by UHG. However, the group’s contractors, dissatisfied with their cut, formed a new group and extorted a second ransom from UHG, publishing portions of the stolen files online to prove their capabilities.

This cyberattack has drawn attention to ongoing concerns about the handling of sensitive data by major healthcare providers and the increasingly brazen tactics of ransomware groups.

Impact on healthcare provider and financial loss

The February cyberattack severely disrupted insurance claims processing nationwide, leaving clinics, pharmacies, and patients struggling to access pre-authorized prescriptions and medical treatments covered by insurance.

Payments to healthcare providers, which are typically processed by Change Healthcare, were abruptly halted as the company took systems offline to contain the attack. Smaller healthcare providers and rural pharmacies were hit especially hard, with many facing significant revenue losses that pushed some close to insolvency.

Ultimately, the breach compromised the personal data of potentially one-third of all US citizens and cost UnitedHealth Group (UHG), Change Healthcare’s parent company, more than $872 million in response and recovery efforts.

These costs included offering accelerated payments and no-interest, no-fee loans to thousands of affected providers, as well as incident response efforts and a complete rebuild of Change Healthcare’s systems. Factoring in revenue loss, the total cost of the attack is expected to exceed $1 billion.

Corporate consolidation and cybersecurity failures

The breach has sparked criticism of UnitedHealth Group, particularly regarding its handling of cybersecurity for such sensitive and expansive datasets. In a hearing, before the US House Energy and Commerce Committee in May, UHG CEO Andrew Witty confirmed that the attackers gained access using stolen credentials that were not protected by multi-factor authentication (MFA), a basic security measure that could have prevented the attack.

“The portal did not have multi-factor authentication,” Witty admitted during the hearing.

Ironically, the company claims to spend approximately $ 300 million annually on cybersecurity.

Lawmakers have raised concerns about UHG’s vast access to patient records, following its 2022 acquisition of Change Healthcare in a $7.8 billion deal. Critics argue that UHG’s size and control over health data were key factors in the breach. Meanwhile, the US Justice Department continues to investigate UHG’s potential anticompetitive practices and the broader implications of the breach.

Besides, Witty also admitted that the company did not have cyber insurance to fend off financial setbacks arising out of cyberattacks.

Ongoing investigations and rising threats

The US government has intensified its efforts to track down ALPHV/BlackCat, offering a $10 million reward for information leading to the capture of the group’s leaders. Despite a 2023 takedown operation, the group has continued to operate, posing a persistent threat to global cybersecurity.

The breach has left a lasting impact on millions of Americans, with Change Healthcare still working to restore portions of its network months after the attack.

“We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it,” Witty said in a statement in April.  As investigations continue, it remains unclear whether the stolen data will resurface in future extortion schemes, raising concerns about the long-term consequences of this unprecedented attack.