UnitedHealth paid ransom to bad actors, says patient data compromised

UnitedHealth Group on Monday said it paid ransom to cyberthreat actors to try and protect patient data, following the February cyberattack on its subsidiary Change Healthcare. The company also confirmed that files containing personal information were compromised in the breach.

“This attack was conducted by malicious threat actors, and we continue to work with the law enforcement and multiple leading cyber security firms during our investigation,” UnitedHealth told CNBC in a statement. “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.”

The company did not specify the ransom payment amount.

UnitedHealth, which has more than 152 million customers, said it has also determined that the cyberthreat actors accessed files containing protected health information and personally identifiable information, according to a release Monday. The files “could cover a substantial proportion of people in America,” the release said.

Change Healthcare offers payment and revenue cycle management tools. The company facilitates more than 15 billion transactions annually, and 1 in every 3 patient records passes through its systems. This means even patients who are not UnitedHealth customers could have been affected by the attack.

UnitedHealth said in the release that 22 screenshots, allegedly of the compromised files, have been uploaded to the dark web. The company said no other data has been published, and it has not seen evidence that doctors’ charts or full medical histories were accessed in the breach.

“We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it,” UnitedHealth CEO Andrew Witty said in the release.

UnitedHealth said that concerned patients can visit a dedicated website for access to resources. The company has launched a call center that will offer free identity theft protections and credit monitoring for two years, the release said.

The call center will not be able to offer any details about individual data impact given the “ongoing nature and complexity of the data review,” UnitedHealth said.