A cyberattack on a subsidiary of a major health insurance company has crippled huge swaths of the American health care system, according to multiple reports.
Change Healthcare, a subsidiary of United Health Group, announced Thursday it had been hit by a cyberattack from a ransomware group, according to The Associated Press. The attack has halted everything from approval of prescriptions and medical procedures to payroll for employees of medical providers, the New York Times reported.
“On Feb. 21, 2024, we discovered a threat actor gained access to one of our Change Healthcare environments,” United Health Group said on a website providing updates on the response to the attack. “Once we became aware of the outside threat, in the interest of protecting our partners and patients, we took immediate action to disconnect Change Healthcare’s systems to prevent further impact.”
Providers across the country were scrambling to cover potential financial shortfalls due to Change Healthcare’s shutdown delaying payments from insurance companies, with the owner of several urgent care facilities in Ohio resorting to loans and dipping into personal savings to pay staff, the NYT reported. A cancer treatment facility in Florida contracted two competing clearinghouses to ensure it could purchase over $300 million in drugs for chemotherapy treatments, according to the NYT.
Change Healthcare processes about 15 billion claims a year involving over $1.5 trillion, about half of all claims in the country, The Washington Post reported. One woman told the Post that she had to pay cash for a prescription that cost $1,700.
The group allegedly responsible for the ransomware attack, AlphV or BlackCat, received a $22 million payment in Bitcoin on Friday, according to Wired.
“HHS is in regular contact with UHG leadership, state partners, and with numerous external stakeholders to better understand the nature of the impacts and to ensure the effectiveness of UHG’s response,” the Department of Health and Human Services said in a statement released Tuesday. “HHS has made clear its expectation that UHG does everything in its power to ensure continuity of operations for all health care providers impacted and HHS appreciates UHG’s continuous efforts to do so.”
“HHS is also leading interagency coordination of the Federal government’s related activities, including working closely with the Federal Bureau of Investigations (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the White House, and other agencies to provide credible, actionable threat intelligence to industry wherever possible,” the statement continued.
Harold Hutchison on March 5, 2024
