Security News > 2024 > March > US govt probes if ransomware gang stole Change Healthcare data

UnitedHealth Group confirmed in late February that Change Healthcare systems and services were shut down after a cyberattack by "Nation-state" hackers, which was later linked to the BlackCat ransomware gang.
Change Healthcare is the largest payment exchange platform used by doctors, healthcare providers, and patients in the U.S. healthcare system and by more than 70,000 pharmacies, while UHG has contracts with over 1.6 million health professionals and 8,000 healthcare facilities across all 50 U.S. states.
"OCR's investigation of Change Healthcare and UHG will focus on whether a breach of protected health information occurred and Change Healthcare's and UHG's compliance with the HIPAA Rules."
The investigation follows the BlackCat ransomware gang's claims that they stole 6TB of data from Change Healthcare's network belonging to "Thousands of healthcare providers, insurance providers, pharmacies, etc."
They said they stole source code for Change Healthcare solutions and sensitive information from many partners, including the U.S. military's Tricare healthcare program, the Medicare federal health insurance program, CVS Caremark, MetLife, Health Net, and many other healthcare insurance providers.
Ransomware gang claims they stole 6TB of Change Healthcare data.
News URL
Related news
- Massive healthcare breaches prompt US cybersecurity rules overhaul (source)
- US charges operators of cryptomixers linked to ransomware gangs (source)
- How Interlock Ransomware Infects Healthcare Organizations (source)
- US healthcare provider data breach impacts 1 million patients (source)
- US healthcare provider data breach impacts 1 million patients (source)
- All your 8Base are belong to us: Ransomware crew busted in global sting (source)
- US sanctions LockBit ransomware’s bulletproof hosting provider (source)
- US indicts 8Base ransomware operators for Phobos encryption attacks (source)
- US newspaper publisher uses linguistic gymnastics to avoid saying its outage was due to ransomware (source)
- New NailaoLocker ransomware used against EU healthcare orgs (source)