CEO Andrew Witty testified before Congress on Wednesday, disclosing a significant cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group. UnitedHealth Group CEO revealed that hackers breached the company’s computer system, releasing ransomware after stealing someone’s password.
The cybercriminals exploited a portal lacking multifactor authentication (MFA), a basic cybersecurity safeguard.
During an hour-long congressional hearing, Witty informed lawmakers that the company has not yet determined how many patients and healthcare professionals were impacted by the cyberattack on Change Healthcare in February. The hearing, which focused on how hackers gained access to Change Healthcare, a separate division of UnitedHealth, raised questions about the lack of basic cybersecurity measures before the cyberattack.
“Change Healthcare was a relatively older company with older technologies, which we had been working to upgrade since the acquisition,” Witty explained. “But for some reason, which we continue to investigate, this particular server did not have MFA on it.”
Multifactor Authentication and Cybersecurity
Multifactor authentication adds a second layer of security to password-protected accounts by requiring users to enter an auto-generated code sent to their phone or email. Despite being a common feature on apps, this safeguard was not in place on the compromised server. Witty assured that all logins for Change Healthcare now have multifactor authentication enabled.
The cyberattack on Change Healthcare was attributed to the Russia-based ransomware gang ALPHV or BlackCat. The group claimed responsibility for the cyberattack, alleging it stole more than six terabytes of data, including “sensitive” medical records.
The attack caused a disruption of payment and claims processing across the country, stressing doctor’s offices and healthcare systems by interfering with their ability to file claims and get paid.
UnitedHealth paid a $22 million ransom in Bitcoin to BlackCat, a decision made by Witty himself. However, despite the ransom payment, some sensitive records from patients were still posted by hackers on the dark web.
“The ransom payment was one of the hardest decisions I’ve ever had to make and I wouldn’t wish it on anyone,” Witty stated.
Scope of the Cyberattack on Change Healthcare and Financial Impact
Change Healthcare processes 15 billion transactions a year, according to the American Hospital Association, meaning that even patients who weren’t customers of UnitedHealth were potentially affected. The company revealed earlier this month that personal information covering a “substantial portion of people in America” may have been taken in the attack.
The breach has cost UnitedHealth Group nearly $900 million, excluding the ransom paid, according to company officials in the first-quarter earnings report last week.
Rising Threat of Ransomware Attacks
Ransomware attacks have become increasingly common within the healthcare industry. According to a 2022 study published in JAMA Health Forum, the annual number of ransomware attacks against hospitals and other healthcare providers doubled from 2016 to 2021. This escalation in cyber threats highlights the urgent need for enhanced cybersecurity measures across the industry.
The breach at Change Healthcare echoes a similar incident in March 2024, where Refuah Health Center faced a cyberattack due to the lack of MFA. The New York Attorney General’s office intervened, resulting in a $1.2 million investment by Refuah in enhancing cybersecurity measures. The health center also agreed to pay $450,000 in penalties and costs, resolving allegations of inadequate cybersecurity controls.
Prioritizing Cybersecurity in Healthcare
Both incidents highlight the critical importance of implementing strong cybersecurity measures, especially in the healthcare sector. With patient data at stake, organizations must invest in multifactor authentication and other advanced security protocols to safeguard sensitive information.
As cyber threats continue to evolve, proactive measures are essential to protect the privacy and security of patient data.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.