{"id":25714,"date":"2025-01-27T07:10:10","date_gmt":"2025-01-27T15:10:10","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2025\/01\/27\/news-19437\/"},"modified":"2025-01-27T07:10:10","modified_gmt":"2025-01-27T15:10:10","slug":"news-19437","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2025\/01\/27\/news-19437\/","title":{"rendered":"UnitedHealth almost doubles victim numbers from massive Change Healthcare data breach"},"content":{"rendered":"\n

UnitedHealth says it now estimates<\/a> that the data breach on its subsidiary Change Healthcare affected 190 million people, nearly doubling its previous estimate from October.<\/p>\n

In May, UnitedHealth CEO Andrew Witty estimated that the ransomware attack compromised the data of a third of US individuals when he testified before the Senate Finance Committee on Capitol Hill. In October, this was largely confirmed when Change Healthcare reported a number of 100,000,000 affected individuals<\/a>.<\/p>\n

Besides the enormous number of victims, the story behind this ransomware attack is also very complex, because of the cybercriminals involved and how the first group that received the ransom payment disappeared without paying their affiliates.<\/p>\n

The ALPHV\/BlackCat ransomware group claimed the initial attack. The UnitedHealth Group reportedly paid $22 million<\/a> to receive a decryptor and to prevent the attackers from publicly releasing the stolen data.<\/p>\n

But shortly after the payment, ALPHV disappeared in an unconvincing exit scam designed to make it look as if the group\u2019s website had been seized by the FBI, forgetting to pay its affiliates in the process. A month later, newcomer ransomware group RansomHub listed Change Healthcare as a victim on its own website, claiming to have the data that ALPHV stole.<\/p>\n

According to BleepingComputer<\/a>, the original attackers joined forces with RansomHub and never deleted the data. A few days later, the listing on the RansomHub leaks site disappeared, which usually means someone paid the ransom.<\/p>\n

Stolen information<\/h2>\n

The data breach at Change Healthcare is the largest healthcare data breach in US history. Although Change Healthcare provided\u00a0details<\/a> about\u00a0the types of medical and patient data that was stolen, it can\u2019t provide exact details for every individual. However, the exposed information may include:<\/p>\n