UnitedHealth Data Breach Affects 190 Million Americans in Largest Healthcare Cyberattack of 2024

The Stolen Data

The breach exposed an unprecedented volume of sensitive information, including:

• Health insurance details
• Medical records
• Billing and payment data
• Personal information, such as phone numbers, addresses, Social Security Numbers, and government ID numbers

This breach now ranks as the largest healthcare data breach in U.S. history.

Details of the Change Healthcare Ransomware Attack

In February 2024, Change Healthcare, a UnitedHealth subsidiary, suffered a ransomware attack that disrupted the U.S. healthcare system on a massive scale.

Key Attack Details:

• Threat Actors: The BlackCat ransomware gang (also known as ALPHV) was identified as the perpetrator.
• Initial Access: The attackers exploited stolen credentials to access the company’s Citrix remote access service, which lacked multi-factor authentication.
• Data Theft and Encryption:
  • 6 TB of data stolen
  • Systems for billing, claims, and prescription fulfillment were encrypted.

This attack caused significant disruptions, including:

• Doctors and pharmacies unable to file claims
• Patients forced to pay full price for prescriptions as discount cards were unusable

Ransom Payments and Fallout

Initial Ransom Payment

UnitedHealth confirmed paying a ransom to BlackCat to:

• Receive a decryptor
• Prevent public release of the stolen data

The ransom was reportedly $22 million.

Double Extortion and Scams

• The affiliate behind the attack claimed BlackCat ran an exit scam, keeping the entire ransom.
• The attacker later partnered with a new ransomware group, RansomHub, and began leaking stolen data to demand additional payments.
• After some data was leaked, the RansomHub entry disappeared, suggesting UnitedHealth may have paid a second ransom.

Financial and Operational Impact

UnitedHealth initially estimated the breach caused $872 million in losses, but by Q3 2024, the figure rose to an expected $2.45 billion in losses for the nine months ending September 30, 2024.