Change Healthcare advised on security but lacked necessary safeguards

TLDR:

• Change Healthcare lacked basic cybersecurity measures despite offering security advice to others
• The company fell victim to a ransomware attack carried out by the BlackCat/ALPHV group

In the months surrounding UnitedHealth Group Inc.’s acquisition of Change Healthcare Inc., Change was found to lack essential security measures, such as multi-factor authentication, despite advocating for cybersecurity in the health care industry. This oversight allowed hackers from the BlackCat/ALPHV group to compromise the company’s systems and deploy ransomware. UnitedHealth CEO Andrew Witty testified before the Senate Finance Committee about the attack and admitted that the cybersecurity practices at Change were lacking even though the company had published articles emphasizing the importance of security. The ransomware attack resulted in potentially millions of health records being stolen, and the company has yet to notify victims due to difficulties in identifying the extent of the breach.

BlackCat/ALPHV, known for targeting health care organizations, had gained notoriety for its ransomware-as-a-service operations. The group’s tactics evolved to include sophisticated methods to steal credentials from inside companies, posing as IT technicians to obtain access. The Cybersecurity and Infrastructure Security Agency issued warnings about the heightened threats to the health care sector, with the attackers encouraging affiliates to target U.S. hospitals in retaliation for law enforcement actions against the group.

The article highlights the challenges faced by companies in maintaining cybersecurity measures and the consequences of overlooking basic security protocols, leading to significant data breaches and financial repercussions.