Cyberattack in healthcare affects more than 100 million people

Threat actors gained access to the data of more than 100 million people during the Change Healthcare breach in February, the U.S. Office for Civil Rights announced Oct. 22.

The hack, information about which was revealed in June, could affect up to a third of Americans. It has proven to be one of the biggest cyber attacks of the year and shows how compromised data can lead to physical damage, such as late delivery of essential medicines.

SEE: Nation-state attackers can search for ‘target-rich, cyber-poor’ organizations such as public infrastructure or health care, said CISA advisor Nicole Perlroth.

What was the Change Healthcare cyber attack?

In February, UnitedHealth Group, the parent company of Change Healthcare, discovers who had introduced an attacker ransomware in the systems of Change Healthcare. The group ALPHV, also known as BlackCat, claimed responsibility for the breach.

In March, Change Healthcare determined that attackers had accessed their systems between February 17 and 20. The company brought in “leading experts in cybersecurity and data analytics.” Mandiant personnel among them, and obtained a copy of the stolen data, analyzing the dataset. United Healthcare released a more thorough account of the incident in April.

In one Senate hearing on the issue in MayUnitedHealth Group CEO Andrew Witty said the company paid a $22 million ransom in Bitcoin to release the stolen data.

Cybersecurity experts It is not advisable to pay a ransom because it rewards threat actors, can cause significant financial damage to the company, and does not guarantee the return of the data. The US government has considered the controversial idea prohibit ransom payments.

Change Healthcare said it cannot specify which data was affected for each individual. In general, the stolen data includes:

• First and last name, address, date of birth, telephone number and email address.
• Health information such as diagnoses, medical record numbers, images and test results.
• Billing, claims and payment information
• Other personal information that may be related to medical records, such as social security numbers, driver’s licenses, identity numbers or passport numbers.

No complete medical histories or doctor’s records were found among the stolen data.

The attack delayed the delivery of prescriptions and led to… an impact on business disruption of $705 million. Overall, Change Healthcare’s financial outlook for next year is lower than expected.

Change Healthcare is offering resources for affected customers

United Healthcare says their investigation into the attack is ongoing but in its final stages.

The company is still sending notifications to those affected. Change Healthcare is offering two years of free IDX credit monitoring and identity theft protection to eligible customers. They provided “trained physicians to provide emotional support services” through a special call center. The call center cannot provide information about what specific data may have been exposed through individual accounts.

United Healthcare recommends that affected patients check their bank accounts and health insurance statements. Unusual activities should be reported to their financial institution or healthcare provider, if applicable.

Ransomware attacks on healthcare have far-reaching consequences

Cyberattacks on healthcare data present a perfect storm of potentially lucrative random opportunities for threat actors and increased distrust among affected customers. Patients may lose access to necessary medications and care may be delayed if operations are disrupted.

In May, a ransomware attack took place on the Ascension hospital system care delayed. Around the same time, the US Advanced Research Projects Agency for Health announced this his intention to invest more than $50 million in tools for information technology professionals in hospital environments to improve their cybersecurity.