On Wednesday February 21, 2024, Change Healthcare\u2014a subsidiary of UnitedHealth Group\u2014experienced serious system outages due to a cyberattack.<\/p>\n
In a Form 8-K filing<\/a> the company said it:<\/p>\n \u201cidentified a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare information technology systems.\u201d<\/p>\n<\/blockquote>\n Change Healthcare is one of the largest healthcare technology companies in the United States. Its subsidiary, Optum Solutions, operates the Change Healthcare platform. This platform is the largest payment exchange platform between doctors, pharmacies, healthcare providers, and patients in the US healthcare system.<\/p>\n The incident led to widespread billing outages, as well as disruptions at pharmacies across the United States.<\/p>\n According to Reuters<\/a>, the group behind the attack is the ALPHV\/BlackCat ransomware group. ALPHV is currently one of the most active groups, and generally associated with Russia. They are certainly no strangers to attacking healthcare providers<\/a>. In our monthly ransomware reviews<\/a> you will typically find them in the top five of ransomware groups. Even after a disruption in December 2023 they returned<\/a> and maintained a high level of activity.<\/p>\n BleepingComputer<\/a> confirmed Reuters assertion, saying it had received information from forensic experts involved in the incident response that linked the attack to the ALPHV ransomware gang.<\/p>\n It would certainly make more sense to us that the attacker was a ransomware group than a nation-state associated group, but both ALPHV and UnitedHealth have not commented on this. That’s no surprise since the investigation is probably still ongoing and solving the security issue is a higher priority.<\/p>\n What the ramifications of any stolen data are, remains to be seen, but they could be very serious given the size of the company and the nationwide application of their electronic health record (EHR) systems, payment processing, care coordination, and data analytics.<\/p>\n In a February 26 update the company says it took immediate action to disconnect Change Healthcare\u2019s systems in order to prevent further impact. You can follow updates about the issue on the dedicated incident report site<\/a>.<\/p>\n Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.<\/p>\n\n
How to avoid ransomware<\/h2>\n
\n
\n