May 24, 2024 By Jennifer Gregory 3 min read

UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker’s ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.

Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a common occurrence with ransomware attacks, and it’s one of the many reasons many experts, including IBM, do not recommend paying ransomware. With proper backups and data recovery processes, organizations can quickly restore their own data and reduce business disruptions. During 2023, ransomware payments like the one made by Change Healthcare reached an all-time high of $1.1 billion.

Testimony reveals details of the breach

According to Witty’s testimony, the ransomware gang BlackCat used compromised credentials to remotely access a Change Healthcare Citrix portal, which enabled remote desktop access, on February 12. The portal was not utilizing multi-factor authentication. BlackCat then deployed ransomware on February 21 inside Change Healthcare’s information technology environments, which encrypted all of Change’s systems so they were inaccessible. Because leaders did not know the point of entry, they severed connectivity with Change’s data center, which prevented the malware from spreading outside Change’s environment to other UnitedHealth Group systems.

The 2024 X-Force Threat Intelligence Index identified BlackCat ransomware, which originated in November 2021, as a top ransomware family. Past BlackCat attacks include the healthcare, government, education, manufacturing and hospitality sectors. However, the gang has been involved in several attacks where sensitive medical and financial data was leaked. By using the Rust programming language, BlackCat can customize ransomware in ways that make it very challenging to detect and analyze. Additionally, BlackCat often attempts double extortion schemes as part of its attacks.

The ransomware attack on Change Healthcare comprised files containing protected health information (PHI) and personally identifiable information (PII). Witty said that the breach could involve a substantial proportion of the American population. However, he shared that at the time of his testimony, doctors’ charts or full medical histories did not appear to be in the data that was breached.

Read the Threat Intelligence Index

Far-reaching effects of the breach

An American Medical Association survey found that four in five clinicians lost revenue due to the widespread nature of the Change Healthcare breach, with 77% experiencing service disruptions. The survey also found that the majority of practice owners (55%) used personal funds to pay bills and payroll due to the billing crisis the situation created. Other disruptions included limited ability to approve prescriptions and medical procedures.

Change Healthcare has also reported that it has lost $872 million to the attack and expects its losses will rise to over $1 billion. With currently 24 lawsuits against Change Healthcare, the organization is asking to consolidate the claims into a class action lawsuit.

Change Healthcare CEO made decision to pay the ransom

Witty told Congress that he personally made the decision to make the ransomware payment. He said it was one of the hardest decisions he’s ever made and one he wouldn’t wish on anyone. After the ransomware payment was made, threat actors still threatened to share the data on the dark web. All the data still has not been identified and recovered.

Further complicating the recovery, a BlackCat affiliate, RansomHub, leaked at least some of the stolen data and attempted additional extortion. RansomHub shared screenshots of the leaked data to the highest bidder on the dark web. In large breaches, such as Change Healthcare, double ransomware attempts are not uncommon and part of the reason many warn against paying the ransom.

Notifying impacted parties

As Change Healthcare is working through the recovery process, Witty told Congress that they are still working to determine who was impacted by the breach and issue notifications. However, many healthcare organizations and groups feel the process should be expedited. On May 8, the American Hospital Association wrote a formal letter on behalf of its members requesting a formal notification process.

“It is important, however, that UHG officially inform the Department of Health and Human Services Office for Civil Rights (OCR) and state regulators that UHG will be solely responsible for all breach notifications required under law and provide them with a timeline for when those notifications will occur,” wrote the AHA.

As the situation continues to evolve, especially the ramifications of the Congressional hearing, the effects of this large and widespread breach will continue to unfold.

To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here.

If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.

More from News

Zero-day exploits underscore rising risks for internet-facing interfaces

3 min read - Recent reports confirm the active exploitation of a critical zero-day vulnerability targeting Palo Alto Networks’ Next-Generation Firewalls (NGFW) management interfaces. While Palo Alto’s swift advisories and mitigation guidance offer a starting point for remediation, the broader implications of such vulnerabilities demand attention from organizations globally.The surge in attacks on internet-facing management interfaces highlights an evolving threat landscape and necessitates rethinking how organizations secure critical assets.Who is exploiting the NGFW zero-day?As of now, little is known about the actors behind the…

Will arresting the National Public Data threat actor make a difference?

3 min read - The arrest of USDoD, the mastermind behind the colossal National Public Data breach, was a victory for law enforcement. It also raises some fundamental questions. Do arrests and takedowns truly deter cyberattacks? Or do they merely mark the end of one criminal’s chapter while others rise to take their place? As authorities continue to crack down on cyber criminals, the arrest of high-profile threat actors like USDoD reveals a deeper, more complex reality about the state of global cyber crime.…

CISA adds Microsoft SharePoint vulnerability to the KEV Catalog

3 min read - In late October, the United States Cybersecurity & Infrastructure Security Agency (CISA) added a new threat to its Known Exploited Vulnerability (KEV) Catalog. Cyber criminals used remote code execution vulnerability in Microsoft SharePoint to gain access to organizations’ networks. The CISA press release states that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” However, Microsoft identified and released a patch for this vulnerability in July 2024. Cybersecurity experts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today