Following the February cyberattack on its business Change Healthcare, UnitedHealth Group paid a ransom to secure patient data. The corporation also revealed that the breach affected files holding personal information.
“This attack was conducted by malicious threat actors, and we continue to work with the law enforcement and multiple leading cyber security firms during our investigation,” the company said in a statement to CNBC. “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.”
The corporation did not reveal the ransom amount.
According to a press release issued Monday, UnitedHealth, which has over 152 million clients, has also established that cyberthreat actors accessed files containing protected health information and personally identifiable information. The files “could cover a substantial proportion of people in America,” according to the publication.
Change Healthcare provides payment and revenue cycle management tools. Every year, the corporation processes more than 15 billion transactions, and one out of every three patient records transit through its networks. This means that people who are not UnitedHealth clients may have been affected by the attack.
UnitedHealth stated in the statement that 22 screenshots of the allegedly affected files had been published to the Dark Web. The company stated that no other data has been published, and there is no proof that doctors’ charts or comprehensive medical histories were obtained during the intrusion.
“We understand that this attack has caused concern and disruption for consumers and providers, and we are committed to doing everything possible to assist and support anyone who may require it,” stated UnitedHealth CEO Andrew Witty in the release.
According to UnitedHealth, worried patients can seek resources through a dedicated webpage. The company has opened a call center that will provide free identity theft protection and credit monitoring for two years, according to the statement.
The call center will be unable to provide any information concerning individual data effect due to the “ongoing nature and complexity of the data review,” according to UnitedHealth.
.
.
.
.
.
