UnitedHealth says Change Healthcare cyberattack cost it $872 million

Source: CBS News

Updated on: April 16, 2024 / 5:18 PM EDT


A cyberattack earlier this year against a UnitedHealth Group subsidiary has proved costly for one of the nation's largest employers.

The health insurance giant on Tuesday noted $872 million in "unfavorable cyberattack effects" in its report of first quarter operations earnings. Those unfavorable effects refer to the February 21 cyberattack on Change Healthcare, which shut down operations at hospitals and pharmacies for more than a week. The $872 million includes "the Change Healthcare business disruption impacts and exclude the cyberattack direct response costs," which likely excludes any amount UnitedHealth may have paid to hackers in ransom.

UnitedHealth confirmed on the day of the breach that the cybercriminals behind the attack was a Russia-based ransomware gang known as ALPHV or BlackCat. The group itself claimed responsibility for the attack, alleging it stole more than six terabytes of data, including "sensitive" medical records.

UnitedHealth did now reveal how much — if at all — it paid the hackers to have their systems restored. However, multiple media sources at the time, including Wired Magazine, reported that a ransom payment for the amount of $22 million was made to BlackCat in the form of bitcoin. UnitedHealth declined a request for comment by CBS MoneyWatch on Tuesday.

Read more: https://www.cbsnews.com/news/unitedhealth-cyberattack-change-healthcare-hack-ransomware/