Hackers breached the pc system of a UnitedHealth Group subsidiary and launched ransomware after stealing somebody’s password, CEO Andrew Witty testified Wednesday on Capitol Hill. The cybercriminals entered by means of a portal that did not have multifactor authentification (MFA) enabled.
Throughout an hourslong congressional listening to, Witty instructed lawmakers that the corporate has not but decided what number of sufferers and well being care professionals had been impacted by the cyberattack on Change Healthcare in February. The listening to centered on how hackers had been capable of acquire entry to Change Healthcare, a separate division of UnitedHealth that the corporate acquired in October 2022. Members of the Home Power and Commerce Committee requested Witty why the nation’s largest well being care insurer didn’t have the essential cybersecurity safeguard in place earlier than the assault.
“Change Healthcare was a comparatively older firm with older applied sciences, which we had been working to improve for the reason that acquisition,” Witty mentioned. “However for some cause, which we proceed to research, this specific server didn’t have MFA on it.”
Multifactor authentication provides a second layer of safety to password-protected accounts by having customers enter an auto-generated code despatched to their cellphone or electronic mail. A standard characteristic on apps, the safeguard is used to guard buyer accounts in opposition to hackers who receive or guess passwords. Witty mentioned all logins for Change Healthcare now have multifactor authentication enabled.
The cyberattack got here from Russia-based ransomware gang ALPHV or BlackCat. The group itself claimed accountability for the assault, alleging it stole greater than six terabytes of information, together with “delicate” medical data. The assault triggered a disruption of fee and claims processing across the nation, stressing physician’s workplaces and well being care techniques by interfering with their capability to file claims and receives a commission.
Witty confirmed Wednesday that UnitedHealth paid a $22 million ransom within the type of bitcoin to BlackCat, a call he made on his personal, based on ready testimony earlier than the listening to. Regardless of the ransom fee, lawmakers mentioned Wednesday that a few of the delicate data from sufferers have nonetheless been posted by hackers on the darkish internet.
The ransom fee “was one of many hardest choices I’ve ever needed to make and I would not want it on anybody,” Witty mentioned.
The dimensions of the assault — Change Healthcare processes 15 billion transactions a 12 months, in accordance to the American Hospital Affiliation — meant that even sufferers who weren’t prospects of UnitedHealth had been probably affected. The corporate mentioned earlier this month that non-public data that might cowl a “substantial portion of individuals in America” might have been taken within the assault.
The breach has already value UnitedHealth Group practically $900 million, firm officers mentioned in reporting first-quarter earnings final week, not together with ransom paid.
Ransomware assaults, which contain disabling a goal’s pc techniques, have grow to be more and more widespread inside the well being care business. The annual variety of ransomware assaults in opposition to hospitals and different well being care suppliers doubled from 2016 to 2021, based on a 2022 examine revealed in JAMA Well being Discussion board.
