Cyberattack On Change Healthcare, CEO Cites Security Lapse

The cybercriminals exploited a portal lacking (MFA), a basic cybersecurity safeguard.

by Samiksha Jain May 2, 2024 in Cybersecurity News, Firewall Daily, Ransomware News Reading Time: 5 mins read 0

592 SHARES 3.3k VIEWS Share on LinkedInShare on Twitter

CEO Andrew Witty testified before Congress on Wednesday, disclosing a significant cyberattack on , a subsidiary of . UnitedHealth Group CEO revealed that hackers breached the company's computer system, releasing ransomware after stealing someone's password.

The cybercriminals exploited a portal lacking multifactor authentication (MFA), a basic cybersecurity safeguard.

During an hour-long congressional hearing, Witty informed lawmakers that the company has not yet determined how many patients and healthcare professionals were impacted by the in February. The hearing, which focused on how hackers gained access to Change Healthcare, a separate division of UnitedHealth, raised questions about the lack of basic cybersecurity measures before the cyberattack.

“Change Healthcare was a relatively older company with older technologies, which we had been working to upgrade since the acquisition,” Witty explained. But for some reason, which we continue to investigate, this particular server did not have MFA on it.

Multifactor Authentication and Cybersecurity

Multifactor authentication adds a second layer of security to password-protected accounts by requiring users to enter an auto-generated code sent to their phone or email. Despite being a common feature on apps, this safeguard was not in place on the compromised server. Witty assured that all logins for Change Healthcare now have multifactor authentication enabled.

The cyberattack on Change Healthcare was attributed to the Russia-based ransomware gang ALPHV or BlackCat. The group claimed responsibility for the cyberattack, alleging it stole more than six terabytes of data, including “sensitive” medical records.

The attack caused a disruption of payment and claims processing across the country, stressing doctor's offices and healthcare systems by interfering with their ability to file claims and get paid.

UnitedHealth paid a $22 million ransom in Bitcoin to BlackCat, a decision made by Witty himself. However, despite the ransom payment, some sensitive records from patients were still posted by hackers on the dark web.

The ransom payment was one of the hardest decisions I've ever had to make and I wouldn't wish it on anyone,” Witty stated.

Scope of the Cyberattack on Change Healthcare and Financial Impact

Change Healthcare processes 15 billion transactions a year, according to the American Hospital Association, meaning that even patients who weren't customers of UnitedHealth were potentially affected. The company revealed earlier this month that personal information covering a “substantial portion of people in America” may have been taken in the attack.

The breach has cost UnitedHealth Group nearly $900 million, excluding the ransom paid, according to company officials in the first-quarter earnings report last week.

Rising Threat of Ransomware Attacks

have become increasingly common within the healthcare industry. According to a 2022 study published in JAMA Health Forum, the annual number of ransomware attacks against hospitals and other healthcare providers doubled from 2016 to 2021. This escalation in cyber threats highlights the urgent need for enhanced cybersecurity measures across the industry.

The breach at Change Healthcare echoes a similar incident in March 2024, where Refuah Health Center faced a cyberattack due to the lack of MFA. The New York Attorney General's office intervened, resulting in a $1.2 million investment by Refuah in enhancing cybersecurity measures. The health center also agreed to pay $450,000 in penalties and costs, resolving allegations of inadequate cybersecurity controls.

Prioritizing Cybersecurity in Healthcare

Both incidents highlight the critical importance of implementing strong cybersecurity measures, especially in the healthcare sector. With patient data at stake, organizations must invest in multifactor authentication and other advanced security protocols to safeguard sensitive information.

As cyber threats continue to evolve, proactive measures are essential to protect the privacy and security of patient data.


Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button