Change Healthcare Cyberattack Impacts Vast Majority of Americans, UnitedHealth Confirms
A cyberattack on Change Healthcare in February has potentially compromised the data of a substantial proportion of people in the United States, UnitedHealth Group (UHG) revealed this week. UHG, the parent company of Change Healthcare, stated that, based on initial data sampling, the company has identified files containing protected health information (PHI) and personally identifiable information (PII).
UHG emphasized that it has not yet detected evidence of exfiltration of sensitive materials such as doctors’ charts or full medical histories from the compromised data. However, the company acknowledges the seriousness of the attack and estimates it will take several months to identify and notify affected customers.
To assist affected individuals, UHG has established a website for information and support, as well as call centers to provide free credit monitoring and identity theft protection for two years. Additionally, the company has become aware of 22 screenshots allegedly taken from Change files that were briefly posted on the dark web.
UHG Confirms Ransom Payment
A UHG spokesperson confirmed to The Hill that the company paid a ransom as part of its commitment to protect patient data from disclosure. This decision aligns with UHG’s priority to minimize the potential impact on its customers.
The cyberattack on Change Healthcare has heightened concerns regarding vertical integration in the healthcare industry, where single companies control various aspects of healthcare services. The Department of Justice (DOJ) reportedly launched an antitrust investigation into UHG earlier this year, focusing on its acquisition of Change Healthcare.
FTC Emphasizes Data Minimization
Federal Trade Commission (FTC) Chair Lina Khan highlighted the vulnerability created by data consolidation during a press conference on Tuesday. Khan advocated for data minimization, emphasizing the importance of limiting the collection and storage of sensitive information by companies.
The Change Healthcare cyberattack serves as a reminder of the potential risks associated with data breaches in the healthcare sector. UHG’s response to the incident, including the establishment of support services for affected individuals, demonstrates the company’s commitment to protecting patient information.
