UnitedHealth paid ransom after massive Change Healthcare cyberattack

The Russia-based cybercriminals who attacked a UnitedHealth Group-owned institution successful February did not locomotion distant from the endeavor empty-handed. 

"A ransom was paid arsenic portion of the company's committedness to bash each it could to support diligent information from disclosure," a UnitedHealth Group spokesperson confirmed with CBS News precocious Monday. 

The spokesperson did not disclose however overmuch the wellness elephantine paid aft the cyberattack, which unopen down operations at hospitals and pharmacies for much than a week. Multiple media sources person reported that UnitedHealth paid $22 million successful the signifier of bitcoin. 

"We cognize this onslaught has caused interest and been disruptive for consumers and providers and we are committed to doing everything imaginable to assistance and supply enactment to anyone who whitethorn request it," UnitedHealth CEO Andrew Witty said successful a connection Monday.

UnitedHealth blamed the breach connected a Russian ransomware pack known arsenic ALPHV oregon BlackCat. The radical itself claimed responsibility for the attack, alleging it stole much than six terabytes of data, including "sensitive" aesculapian records, from Change Healthcare, which processes wellness security claims for patients who visited hospitals, aesculapian centers oregon pharmacies.

The standard of the onslaught — Change Healthcare processes 15 cardinal transactions a year, according to the American Hospital Association —meant that adjacent patients weren't customers of UnitedHealth were perchance affected. The onslaught has already cost UnitedHealth Group astir $900 million, institution officials said successful reporting first-quarter net past week.

Ransomware attacks, which involve disabling a target's machine systems, person go progressively communal wrong the wellness attraction industry. The yearly fig of ransomware attacks against hospitals and different providers doubled from 2016 to 2021, according to a 2022 survey published successful JAMA Health Forum.

The Change Healthcare incidental was "straight retired an onslaught connected the U.S. wellness strategy and designed to make maximum damage,"  Witty told analysts during an net telephone past week. Ultimately, the cyberattack is expected to outgo UnitedHealth betwixt $1.3 cardinal and $1.6 cardinal this year, the institution projected successful its net report.

In:
• UnitedHealth Group
• Ransomware