UnitedHealth Admits Paying Ransomware Gang to Prevent Massive Data Breach

UnitedHealth Group recently confirmed that they had to pay a ransom to cybercriminals to protect sensitive data stolen during a ransomware attack on Optum in late February. This attack wasn’t just any ordinary cybercrime; it led to a massive outage that affected Change Healthcare payment systems, impacting several critical services used by healthcare providers and pharmacies throughout the U.S. These services included payment processing, prescription writing, and insurance claims.

Can you believe that the organization reported $872 million in financial damages from this single cyberattack? It’s mind-boggling! But it doesn’t stop there. The BlackCat/ALPHV ransomware gang claimed responsibility for the attack, alleging that they stole 6TB of sensitive patient data. And in early March, they even pulled off an exit scam after allegedly receiving $22 million in ransom from UnitedHealth.

During that time, one of the gang’s affiliates, known as “Notchy,” claimed they had UnitedHealth data because they conducted the attack and that BlackCat cheated them out of the ransom payment. The transaction was visible on the Bitcoin blockchain, and researchers confirmed it reached a wallet used by BlackCat hackers.

As if things couldn’t get more complicated, a week later, the U.S. government launched an investigation into whether health data had been stolen in the ransomware attack at Optum. And by mid-April, the extortion group RansomHub raised the stakes even higher for UnitedHealth by starting to leak what they claimed to be corporate and patient data stolen during the attack. UnitedHealth’s patient data reached RansomHub after “Notchy” partnered with them to extort the company again.

Data stolen, ransom paid

In a statement, UnitedHealth confirmed that they paid a ransom to prevent patient data from being sold to cybercriminals or leaked publicly. The company said, “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.”

We checked RansomHub’s data leak website and can confirm that the threat actor has removed UnitedHealth from its list of victims. UnitedHealth’s removal from RansomHub’s site may indicate that today’s confirmation is for a payment to the new ransomware gang rather than the alleged $22 million payment to BlackCat in March.

Recently, UnitedHealth posted an update on its website announcing support for people whose data had been exposed by the February ransomware attack, officially confirming the data breach incident. The company stated that based on initial targeted data sampling, they have found files containing protected health information (PHI) or personally identifiable information (PII). This could potentially affect a substantial proportion of people in America. However, the company reassures patients that they have not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.

UnitedHealth further explained that only 22 screenshots of stolen files, some containing personally identifiable information, were posted on the dark web, and that no other data exfiltrated in the attack has been published “at this time.” The organization has promised to send personalized notifications once it completes its investigation into the type of information compromised.

As part of its efforts to support those impacted, UnitedHealth has set up a dedicated call center offering two years of free credit monitoring and identity theft protection services. Currently, 99% of the impacted services are operational, medical claims flow at near-normal levels, and payment processing stands at approximately 86%.

A call for action: Protect yourself and your organization

UnitedHealth’s experience is a sobering reminder of the ever-present threat of cyberattacks and the importance of taking cybersecurity seriously. Don’t let your organization become the next victim. Reach out to us, and together, we’ll help you stay one step ahead of cybercriminals. Keep coming back to learn more about the latest cybersecurity trends and best practices to safeguard your valuable data.