UnitedHealth has verified that the ransomware incident impacting its Change Healthcare division last February has affected approximately 190 million individuals in the United States — nearly twice the earlier estimates.
The health insurance behemoth disclosed this updated figure to TechCrunch on Friday after the market close.
“Change Healthcare has assessed that the estimated total of individuals affected by the cyberattack stands at around 190 million,” stated Tyler Mason, a representative of UnitedHealth Group, in an email to TechCrunch. “The vast majority of these individuals have already received individual or substitute notices. The final total will be confirmed and reported to the Office for Civil Rights at a later point.”
The spokesperson for UnitedHealth emphasized that the company is “unaware of any misuse of individuals’ information stemming from this incident and has not detected any electronic medical record databases present in the data during the review.”
The cyberattack that occurred in February 2024 represents the largest breach of medical information in U.S. history, leading to prolonged outages across the healthcare sector. Change Healthcare, a major player in health technology and a subsidiary of UnitedHealth, is among the top processors of medical records and healthcare claims in the United States.
This data breach resulted in the compromise of extensive amounts of health and insurance-related information, with some data published online by the hackers who took responsibility for the attack. Change Healthcare subsequently paid a minimum of two ransoms to prevent the additional release of the stolen information.
Previously, UnitedHealth estimated the number of affected individuals to be around 100 million when they submitted a preliminary analysis to the Office for Civil Rights, a unit under the U.S. Department of Health and Human Services that oversees data breaches.
In its breach notification, Change Healthcare indicated that the cybercriminals accessed personal details including names and addresses, birth dates, phone numbers, email addresses, and government identity documents such as Social Security numbers, driver’s license numbers, and passport numbers. The compromised health data encompasses diagnoses, medications, test results, imaging, care and treatment plans, and health insurance details. Additionally, Change disclosed that financial and banking information from patient claims was also included in the data.
This breach is attributed to the ALPHV ransomware group, a prominent Russian-speaking cybercrime organization. According to statements made by UnitedHealth Group’s CEO Andrew Witty to lawmakers last year, the hackers infiltrated Change’s systems using a stolen credential that lacked multi-factor authentication protection.
Compiled by Techarena.au.
Fanpage: TechArena.au
Watch more about AI – Artificial Intelligence
