UnitedHealth CEO says company paid hackers $22 million ransom

UnitedHealth Group CEO Andrew Witty confirmed for the primary time that the corporate paid a $22 million ransom to hackers who breached its subsidiary Change Healthcare and precipitated widespread fallout throughout the health-care sector. Witty’s feedback had been made throughout a Wednesday listening to earlier than the U.S. Senate Committee on Finance.

Change Healthcare offers fee, income administration and different options like e-prescription software program. The corporate disconnected affected techniques when the risk was detected, leaving many docs briefly unable to fill prescriptions or receives a commission for his or her companies.

UnitedHealth advised CNBC in April that it paid a ransom to try to shield affected person information. Earlier studies had found a $22 million switch on Bitcoin’s blockchain, however the firm had not confirmed the determine till now.

„The choice to pay a ransom was mine,” Witty stated. „This was one of many hardest choices I’ve ever needed to make, and I would not want it on anybody.”

UnitedHealth is among the largest corporations on the planet, with a roughly $450 billion market cap. Its enterprise unit Optum — which offers care to 103 million prospects — and Change Healthcare — which touches one in three affected person data — merged in 2022.

Committee Chairman Sen. Ron Wyden, D-Ore., stated in his opening remarks that the Change Healthcare breach serves as a „dire warning concerning the penalties of too-big-to-fail mega-corporations.”

„Firms which are so large have an obligation to guard their prospects and to steer on this problem,” Wyden stated.

Witty advised the committee that cybercriminals accessed Change Healthcare via a server that was not protected by multi-factor authentication, or MFA, which requires customers to confirm their id in a minimum of two other ways. He stated UnitedHealth now has MFA in place throughout all external-facing techniques.

„Because of this malicious cyberattack, sufferers and suppliers have skilled disruptions and individuals are apprehensive about their personal well being information,” Witty stated. „To all these impacted, let me be very clear: I’m deeply, deeply sorry.”

Sen. Thom Tillis, R-N.C., held up a brilliant yellow copy of „Hacking for Dummies” through the listening to, saying the breach is UnitedHealth’s duty to repair.

„That is some primary stuff that was missed, so disgrace on inner audit, exterior audit and your techniques people tasked with redundancy, they are not doing their job,” Tillis stated.

A submitting with the U.S. Securities and Trade Fee stated that UnitedHealth found {that a} cyber risk actor accessed a part of Change Healthcare’s info expertise community in late February.

Witty stated Change Healthcare’s core techniques are again on-line, although a few of its secondary help features are nonetheless being restored.

UnitedHealth stated in February that the ransomware group Blackcat was behind the assault. Blackcat, which additionally goes by the names Noberus and ALPHV, steals delicate information from establishments and threatens to publish it except a ransom is paid, based on a December launch from the U.S. Division of Justice.

UnitedHealth confirmed in April that recordsdata containing protected well being info and personally identifiable info had been compromised within the breach. The corporate stated an information overview is ongoing, so it could possibly be months earlier than the corporate can notify affected people.

Witty stated Wednesday that UnitedHealth is working with regulators to evaluate the breach and to tell folks if their info has been compromised „as quickly as potential.”

Early in March, UnitedHealth launched a short lived funding help program to assist help suppliers which have skilled money circulation disruptions as a result of cyberattack. There aren’t any charges, curiosity or different prices on prime of the funds, and suppliers have 45 days to repay the funds as soon as their commonplace fee operations resume. 

Throughout the listening to, Witty stated the corporate has not but requested anybody for mortgage repayments, and it is going to be as much as suppliers to find out when their operations have formally returned to regular.

Witty didn’t immediately disclose whether or not UnitedHealth will present further help to suppliers who could also be contending with different loans and curiosity funds due to the breach.

Sen. Michael Bennet, D-Colo., pressed Witty to share how UnitedHealth is working to make sure one thing just like the Change Healthcare breach won’t occur once more. Witty stated the corporate plans to share what it discovers concerning the breach with others, including that there is a must concentrate on lowering the speed of cyberattacks on the health-care sector.

„We’re clearly making an attempt to take our duty on this assault. We’re additionally making an attempt to be taught from it,” he stated.