Compounded Crisis: Change Healthcare’s Breach Escalates with New Threats

Joao Correia

April 29, 2024 - Technical Evangelist

Two months ago, Change Healthcare, a linchpin in the U.S. healthcare system, fell victim to a sophisticated cyberattack by the infamous BlackCat/ALPHV ransomware group. The breach not only paralyzed numerous healthcare services but also exposed the company to extortion demands, underlining severe vulnerabilities in the healthcare sector’s cybersecurity framework.

This article revisits the initial incident and examines recent developments that threaten to deepen the crisis for Change Healthcare and its stakeholders. You can find the initial report on the incident here.

Recap of the Initial Cyberattack

On February 21, 2024, Change Healthcare, a subsidiary recently acquired by UnitedHealth Group in a colossal $8 billion deal, reported a crippling cyberattack that disrupted its services nationwide. The attacker, identified as the BlackCat/ALPHV group, deployed ransomware that affected over 111 services integral to healthcare operations, from billing to pharmacy services, impacting hospitals, clinics, and pharmacies across the country.

The cybercriminals demanded a ransom in Bitcoin, which was paid, but the incident took a dramatic turn when discrepancies appeared in a supposed law enforcement seizure of the ransomware group’s data leak site. An affiliate of BlackCat/ALPHV alleged that the group had executed an exit scam, withholding the ransom proceeds. The affiliate further hinted at retaining stolen data, which purportedly included sensitive financial and medical information.

Twist in the Tale

The saga added a layer of deceit when it was revealed that, despite assurances of data deletion, the ransomware-as-a-service provider might have reneged on their promise. This breach highlighted the adage “no honor among thieves,” as internal disputes within the cybercriminal group surfaced publicly.

Recent Developments

Just as UnitedHealth Group attempted to reassure stakeholders by announcing lesser-than-expected financial impacts – a forecast of up to $1.6 billion in related costs and maintaining their earnings outlook – the situation deteriorated further. Reports from Axios and WIRED indicate that another ransomware group, RansomHub, has begun distributing snippets of the stolen data, with a threat to release more unless additional ransom demands are met. This data includes highly sensitive patient information, revealing an alarming level of exposure and potential misuse.

Implications of Data Exfiltration

The revelation of data exfiltration introduces a significant escalation in the cyberattack’s ramifications. Often regarded as ransomware’s “younger sibling,” data theft compounds the challenges faced by victims of such breaches, extending the threat landscape to potentially involve fraudulent activities and identity theft. This development undermines UnitedHealth’s attempts to downplay the severity of the initial breach and could have far-reaching effects on its recovery efforts and reputation.

As Change Healthcare struggles with the fallout from this extended cybersecurity crisis, the healthcare sector is reminded of the critical need for robust security measures and proactive threat management strategies. This incident serves as a reminder that “critical infrastructure” is more than just oil pipelines. A single cyberattack, against a key player in the healthcare industry, forced countless players in that space to operate at reduced capacity, with a direct impact on the day-to-day lives of millions of citizens.

As threats evolve, the damage can extend far beyond the initial attack. The ongoing saga at Change Healthcare highlights the importance of vigilance and rapid response in protecting sensitive data and maintaining public trust in our healthcare systems. Moreover, regulatory bodies need to enforce stricter compliance measures to ensure that healthcare providers and their associates prioritize data protection to prevent future incidents.

This developing story will continue to be monitored closely, as the implications for Change Healthcare, UnitedHealth Group, and the broader healthcare ecosystem remain significant and still unfolding.

Summary