UnitedHealth pays ransom to protect patient data after cyberattack
MINNESOTA, UNITED STATES — UnitedHealth Group has admitted to paying an undisclosed ransom to cybercriminals in an attempt to safeguard patient data stolen during a February cyberattack on its subsidiary, Change Healthcare.
$22 million bitcoin ransom confirmed
According to a CNBC report, UnitedHealth did not specify the ransom amount, but earlier this year, Reuters reported that the cybercriminal group claiming responsibility received $22 million in bitcoins.
Initially, UnitedHealth remained mum about the payment, stating that the company was focused on “investigation and recovery.”
Ransom payments are a controversial issue. The federal government urges hospitals and healthcare organizations to refrain from such payments to discourage data theft.
However, healthcare companies bear the responsibility of protecting patient data and restoring systems promptly. UnitedHealth stated that while 22 screenshots of compromised files have been released on the dark web, no other data has been published.
Widespread healthcare industry disruption
The incident crippled billing, payment processing, and other core operations across the industry, forcing providers to implement manual workarounds.
The frequency of ransomware attacks against healthcare providers has surged in recent years, with the number doubling from 2016 to 2021, according to a 2022 study published in JAMA Health Forum.
A survey by the American Healthcare Association found that the cyberattack has affected the cash flow at 80% of hospitals, with 60% of those hospitals reporting an impact on revenue of at least $1 million per day.
In its Q1 SEC filing, UnitedHealth reported that the ransomware strike cost $872 million in the first quarter of 2024, projecting an overall financial impact of up to $1.6 billion for the year. This highlights the significant financial and operational repercussions of such cyberattacks on the healthcare industry.
A month after the attack, Change Healthcare announced its plans to restore the processing of a backlog of $14 billion in medical claims.
The UnitedHealth Group subsidiary said it also advanced more than $2.5 billion to affected providers at no cost through a Temporary Funding Assistance Program.
