Company Says Change Healthcare Hackers Stole Sensitive Data

UnitedHealthGroup said for the first time that hackers behind a February ransomware attack against Change Healthcare breached sensitive health information, an admission that triggers a regulatory countdown clock for public disclosures and individual notification.

See Also: OnDemand | Leveraging Automation to Reduce Third Party and Supply Chain Risk in Healthcare

Buried in a frequently asked questions portion of its website, UnitedHealth Group in an update posted Monday said a review of data affected by the Feb. 21 attack is underway by a “leading” forensics expert.

“At this time, we know that the data had some quantity of personal health information and personally identifiable information,” the company said. “We are working to determine the quantity of impacted data, and we are fully committed to providing notifications to impacted individuals when determinations are able to be made.” Change Healthcare is an intermediary between caregivers and insurance companies that processes sensitive information as part of claims settlements. Neither the subsidiary nor its parent company immediately responded to a request for comment.

The low-key admission from the company came as cybercriminal group RansomHub this week reportedly posted UnitedHealth Group data for sale on its dark web site and displayed several screenshots supposedly showing samples of data that an affiliate of another ransomware group – BlackCat/Alphv – exfiltrated in the attack (see: Second Gang Shakes Down UnitedHealth Group for Ransom).

Change Healthcare’s hesitancy to say whether ransomware hackers breached sensitive information covered by the Health Insurance Portability and Accountability Act has run deep. A breach of HIPAA data requires the company to notify federal regulators and potentially costly individual notification requirements sent within 60 days of the breach’s discovery.

Legally, the burden of notification could be borne by the individual hospitals, clinics, and doctor practices that relied on Change Healthcare for claims processing, but UnitedHealth Group has indicated it will assume the burden of breach notification. The quantity of notifications for the incident could reach millions of individuals, since it’s typically impossible to say with precision whether hackers accessed, viewed or disclosed any particular record in a database. Any intrusion into a database effectively means all individuals whose information is collected there should receive a breach notification.

Expert witnesses testifying as recently as Tuesday at a congressional hearing about the Change Healthcare attack said that to date, UnitedHealth Group had not publicly confirmed whether PII and PHI was compromised in the attack, despite cybercriminals’ claims (see: Congress Asks What Went Wrong in Change Healthcare Attack).

Earlier in the month, UnitedHealth Group has confirmed data had been “taken” in the attack but said it had only started to analyze the types of sensitive personal, financial and health information potentially compromised attack (see: UnitedHealth Group Admits Patient Data Was ‘Taken’ In Mega Attack).

Analysis of affected data is difficult, UnitedHealth Group said in the Monday update. “This is taking time because Change Healthcare’s own systems were impacted by the event and difficult to access, so it was not safe to immediately pull data directly from the Change systems,” the company said. “We recently obtained a dataset that is safe for us to access and analyze. Because of the mounting and decompression procedures needed as a first step, we have only recently reached a position to begin analyzing the data.”

“We continue to be vigilant, and we are committed to providing appropriate support to people whose data is found to have been compromised,” it added.