There is now a one in three chance that your private financial and health information is in the possession of criminals or terrorists who can now use it to rob or swindle you.
UnitedHealth Group (UHG) CEO Sir Andrew Witty made that estimate in testimony to the House Committee on Energy and Commerce.
Your vulnerability is the result of a major cyber attack on Change Healthcare (CHC), a part of UnitedHealth Group, that occurred February 24th. Change manages the processing of insurance and pharmacy claims, provider payments, and treatment authorization. Although the attack caused immediate havoc in the healthcare industry, the impact on individuals is just now coming to light.
What You Can Do
If you think you may have been compromised by the Change cyber attack, the company will pay for two years of credit monitoring and identity protection services.
In addition, CHC recommends you regularly monitor financial and health records. That includes:
- Checking healthcare statements for charges regarding unauthorized or fictitious treatments. If you find bogus information, you should contact your health plan or provider.
- Reviewing bank statements, credit card statements, credit reports, and tax returns for unauthorized activity. Any false information should be reported to your bank or the appropriate agency or credit company.
Change is also offering live support Monday through Friday from 8 a.m. to 8 p.m. CT at 1-866-262-5342.
In addition, the company has established online resources at changecybersupport.com.
Healthcare Impact
Change processes about half of all medical claims in the United States, according to a 2022 lawsuit. That amounts to service for around 900,000 doctors, 118,000 dentists, 33,000 pharmacies, 5,500 hospitals, and 600 laboratories.
The platform processes about 15 billion transactions per year valued at $1.5 trillion.
The cyberattack on Change shut down large portions of the healthcare industry. Although this month United Healthcare reported it has restored the majority of its services. The company has also made $9 billion in advance payments and interest-free loans to service providers.
The impact on the healthcare system included:
- Creating a backlog of unpaid claims, which resulted in cash flow problems for medical practices and hospitals.
- Preventing or delaying the filling of prescriptions.
- Hampering or preventing the submission of claims or verifying eligibility for benefits.
- Delaying patient care and reimbursement.
Change has notified healthcare providers, insurance companies, and related organizations that patient information was stolen in the cyber attack. The firm began mailing notices to individuals who may have been affected within the last few days.
Cyber Attack Nets Vast Amount of Data
CHC says the exposed data may include:
- Personal contact information, including addresses and dates of birth.
- Health insurance information, including member/group ID numbers and Medicare or Medicaid ID numbers.
- Health information, including medical record numbers, providers, diagnoses, medications, test results, and images.
- Billing, claims, and payment information, including banking information and balances due.
- Other personal information, including Social Security numbers, driver’s license/state ID numbers, and passport numbers.
In April, RansomHub, a hacker group, began offering to sell information from the CHC breach on the dark web, according to Dark Web Informer, which monitors hacker activities. In a post, the group claimed to have individual medical and dental records, health records on active duty military, insurance records, and the addresses and social security numbers of individuals.
“For most of the U.S. individuals out there doubting us, we probably have your personal data,” RansomHub wrote.
UnitedHealth Profits Grow Despite Cyber Attack
UnitedHealth Group reported its losses from the cyber attack topped $1.1 billion in the first quarter and estimates the total bill could be as much as $2.45 billion for the year.
At the same time, the healthcare behemoth is rolling in dough. In a second-quarter earnings report last week, UnitedHealth showed a profit of $4.2 billion on revenues of $98.9 billion.
The rosy financial picture comes even though UnitedHealth paid $22 million in bitcoin as ransom demanded by the attacker ALPHV/BlackCat ransomware group.
How It Happened
In testimony to the Senate Finance Committee, Witty said stolen login information was used to access a server that did not use multifactor authentication (MFA).
Multifactor authentication is common when gaining entry to sites. You have probably logged onto a financial site that takes your username and password – then sends you a code via text or email to complete your access. That is multifactor authentication.
UHC acquired Change in October 2022. Much of the company’s technology was out of date, according to Willy. As a result, UHC was bringing that technology up to speed when the attack took place.
“We were in the process of upgrading the technology that we had acquired,” said Witty. “But within there, there was a server, which I’m incredibly frustrated to tell you, was not protected by MFA. “That was the server through which the cybercriminals were able to get into Change. And then they led off a ransomware attack, if you will, which encrypted and froze large parts of the system.”
Lawsuit Filed Against United Health
Monday the National Community Pharmacists Association and several dozen providers in several states filed suit against UHC, CHC, and UHC subsidiary Optimum. The class action charges that UHC and its subsidiaries failed to take precautions against a possible cyber attack and mislead clients about the security of its network.
The suit states that:
“Because defendants disconnected the Change Platform, many health care providers lost their primary (and in some cases their only) source of claims processing for their patients and did not receive payment. Healthcare providers had to absorb these upfront costs. In addition to the losses from not being paid, many pharmacies had to take out loans or deplete their reserves to buy expensive new software.”
Read More:
Come back to what you love! Dollardig.com is the most reliable cash-back site on the web. Just sign up, click, shop, and get full cashback!
Max K. Erkiletian began writing for newspapers while still in high school. He went on to become an award-winning journalist and co-founder of the print magazine Free Bird. He has written for a wide range of regional and national publications as well as many on-line publications. That has afforded him the opportunity to interview a variety of prominent figures from former Chairman of the Federal Reserve Bank Paul Volker to Blues musicians Muddy Waters and B. B. King. Max lives in Springfield, MO with his wife Karen and their cat – Pudge. He spends as much time as possible with his kids, grandchildren, and great-grandchildren.
Comments