Cyberattack on UnitedHealth Group’s Optum Linked to BlackCat/ALPHV Ransomware Gang
The BlackCat/ALPHV ransomware gang has taken credit for a cyberattack on Optum, a subsidiary of UnitedHealth Group (UHG), causing an ongoing outage affecting the Change Healthcare platform.
Change Healthcare is the primary payment exchange platform used by over 70,000 pharmacies nationwide. With 440,000 employees globally, UHG is the largest healthcare company in the world, serving over 1.6 million physicians and care professionals in 8,000 healthcare facilities.
According to BlackCat, they accessed and stole 6TB of data from Change Healthcare, which includes sensitive information from numerous healthcare providers, insurance companies, pharmacies, and more. They claim to have obtained source code for Change Healthcare solutions and data from partners like Tricare, Medicare, CVS Caremark, MetLife, and other insurance providers.
The stolen data includes medical records, insurance information, dental records, payment details, claims information, PII, and data on active U.S. military personnel.
Optum is actively working on restoring its affected systems, and UnitedHealth Group systems remain unaffected. While UnitedHealth Group VP Tyler Mason did not confirm BlackCat’s involvement, he mentioned that most of the impacted pharmacies have shifted to alternate electronic claim procedures to mitigate issues.
BlackCat denied allegations that the breach involved a critical ScreenConnect authentication bypass flaw. The FBI, CISA, and HHS have issued warnings about Blackcat ransomware affiliates targeting U.S. healthcare organizations, citing an increase in attacks since December 2023.
The FBI has linked BlackCat to over 60 breaches and estimated their earnings from ransoms to be at least $300 million. The U.S. State Department is offering a reward of up to $15 million for information leading to the identification or location of BlackCat gang leaders involved in ransomware attacks.
