It’s official: over 100 million people had their personal information and healthcare data stolen in the Change Healthcare ransomware attack, making it the largest healthcare data breach in recent years. UnitedHealth, the parent company of Change Healthcare, has finally confirmed this staggering number.

Just imagine that: “maybe a third” of all Americans’ health data was exposed in this attack, as UnitedHealth CEO Andrew Witty warned during a congressional hearing in May. This is a massive breach that has affected a “substantial proportion of people in America.”

So, what exactly was stolen during this ransomware attack? According to data breach notifications sent by Change Healthcare, the sensitive information includes health insurance details, medical history, billing and payment info, and other personal data like Social Security numbers and driver’s license numbers. Not everyone’s complete medical history was exposed, but still, the sheer scale of this breach is alarming.

How did the Change Healthcare ransomware attack happen?

In February, the UnitedHealth subsidiary Change Healthcare fell victim to a ransomware attack that led to widespread outages in the U.S. healthcare system. The culprits? The BlackCat ransomware gang, aka ALPHV, who used stolen credentials to breach the company’s Citrix remote access service, which did not have multi-factor authentication enabled.

During the attack, the criminals stole a whopping 6 TB of data and encrypted computers on the network. This caused the company to shut down IT systems to prevent further damage. In the aftermath, doctors and pharmacies were unable to file claims, and patients were forced to pay full price for medications because pharmacies couldn’t accept discount prescription cards.

UnitedHealth Group ended up paying a ransom demand of allegedly $22 million to receive a decryptor and ensure the stolen data would be deleted. However, the ransomware gang pulled a fast one: they suddenly shut down and stole the entire payment for themselves, leaving Change Healthcare’s data in the hands of a rogue affiliate.

As if that wasn’t enough, the affiliate partnered with a new ransomware operation named RansomHub and began leaking some of the stolen data, demanding an additional payment for the data not to be released. It’s unclear whether United Health paid a second ransom demand, as the entry for Change Healthcare on RansomHub’s data leak site disappeared a few days later.

The financial toll of this attack has been enormous. UnitedHealth reported in April that the ransomware attack caused $872 million in losses, which increased to an expected $2.45 billion for the nine months to September 30, 2024, as part of their Q3 2024 earnings.

What can we learn from this massive breach?

This incident highlights the importance of strong cybersecurity measures, especially in the healthcare industry. We must prioritize the protection of sensitive data and invest in robust security systems to prevent future attacks. It’s time for all of us to take cybersecurity seriously.

Stay informed and keep coming back to learn more about the latest cybersecurity news, threats, and best practices. Together, we can work towards a safer digital landscape. If you have any questions or concerns about your organization’s security, don’t hesitate to reach out to us. We’re here to help.

Imagine this: you’re a hugely successful healthcare solutions provider, with operations in 32 countries and a revenue of over $12 billion in 2022. You’ve earned your place as a Fortune 500 company. But then, out of nowhere, you’re hit by not one, but two cyberattacks in a row. Sounds like a nightmare, right? Well, that’s precisely what happened to Henry Schein in 2023.

The Double Whammy of Cyberattacks

On October 15, 2023, Henry Schein was forced to take some systems offline due to a cyberattack that impacted their manufacturing and distribution operations. The culprits? The notorious BlackCat Ransomware gang, who claimed responsibility and boasted about stealing 35 TB of sensitive files.

But the trouble didn’t end there. On November 22, the company disclosed that they were hit by the same gang yet again. This time, the ransomware gang encrypted Henry Schein’s network after negotiations failed and even threatened a third attack if a ransom was not paid.

While it’s unclear if the attackers followed through with their threats, they did release some of the stolen data on their leak site.

The Aftermath: Over 160,000 People Affected

Fast forward to over a year later, and Henry Schein has finally confirmed the extent of the damage. In a data breach notification to the Maine Attorney General, the company revealed that the ransomware gang managed to steal the personal data of 166,432 people during these attacks.

It took a considerable amount of time and resources to review the affected files and identify the information that was obtained by the unauthorized third party. The investigation determined that personal information, along with other sensitive data, was impacted during the incident.

We reached out to Henry Schein to ask about the type of data stolen but did not receive a response. However, the company is now offering impacted users a free 24-month membership to Experian’s IdentityWorksSM to help monitor their credit history and detect signs of fraud.

What Can You Learn from This?

As a US reader, you might be thinking, “Why should I care about a healthcare solutions provider halfway across the world?” Well, the truth is, cyberattacks can happen to anyone, anywhere. And as we’ve seen with Henry Schein, even the biggest and most successful companies aren’t immune.

So, what can you do to protect yourself and your business? The best way is to stay informed and be proactive about your cybersecurity practices. That’s where we come in. Our IT Services team is dedicated to helping you stay ahead of the curve and ensure that you’re well-equipped to handle any cyber threats that come your way.

Don’t wait until it’s too late. Contact us today to learn more about our cybersecurity services and how we can help you safeguard your valuable data. And remember, keep coming back to stay informed and up-to-date on the latest cybersecurity news and trends.

A Wake-Up Call from a Massive Data Breach

Imagine the shock and fear when you learn that your personal information has been compromised in a cyberattack. For over 800,000 people, this nightmare became a reality when insurance administrative services company Landmark Admin fell victim to a data breach in May.

Who is Landmark Admin and Why Does it Matter?

Landmark Admin is a third-party administrator for insurance companies, providing essential back-office services like new business processing and claims administration for major insurance carriers. Some of these carriers include American Monumental Life Insurance Company, Pellerin Life Insurance Company, American Benefit Life Insurance Company, Liberty Bankers Life Insurance Company, Continental Mutual Insurance Company, and Capitol Life Insurance Company.

What Happened During the Cyberattack?

According to a filing with the Main Attorney General’s office, Landmark detected suspicious activity on May 13th, prompting the company to shut down its IT systems and remote access to its network to prevent the spread of the attack. They then enlisted the help of a third-party cybersecurity company to address the incident and investigate whether any data was stolen.

What Did the Investigation Discover?

During the investigation, Landmark found evidence that the attacker accessed files containing the personal information of 806,519 people. The affected individuals’ data included first and last names, addresses, Social Security numbers, tax identification numbers, driver’s license numbers, passport numbers, financial account numbers, medical information, dates of birth, health insurance policy numbers, and life and annuity policy information.

Landmark is notifying affected individuals by mail and will continue to update them as the investigation progresses. However, at this time, no threat actors have claimed responsibility for the attack, leaving the true nature of the incident—whether ransomware or data theft—unknown.

What Should Impacted Individuals Do Now?

Due to the sensitive nature of the stolen data, it’s crucial for impacted people to keep a close eye on their credit reports and bank accounts for any suspicious activity. The breach serves as a stark reminder of the importance of cybersecurity and the need to protect our personal information.

Don’t Wait Until It’s Too Late

Don’t let this story become your reality. Be proactive in safeguarding your personal and business data by contacting us to learn more about how we can help you stay one step ahead of cyber threats. By working together, we can ensure that your information remains secure and out of the wrong hands.