Change Healthcare Data Breach: What To Do

The Change Healthcare data breach, confirmed on October 22, 2024, by UnitedHealth, has become one of the largest healthcare data breaches in U.S. history. This cyberattack exposed the sensitive personal and health information of over 100 million individuals. It was caused by a ransomware attack on Change Healthcare, a subsidiary of UnitedHealth, in February 2024. Here, we provide a clear and comprehensive overview of the incident, its consequences, and the questions people might have.

Change Healthcare data breach: What happened?

In February 2024, Change Healthcare was hit by a ransomware attack orchestrated by the ALPHV/BlackCat group. The attackers used stolen credentials to breach the company’s remote access system, which lacked multi-factor authentication (MFA). This allowed them to steal around six terabytes of data and encrypt the company’s IT systems, leading to widespread outages across the healthcare sector. The attack affected numerous healthcare facilities, including hospitals, clinics, and pharmacies, which heavily relied on Change Healthcare for processing insurance claims and other essential operations.

UnitedHealth, the parent company of Change Healthcare, admitted to paying a ransom of $22 million to the attackers for a decryptor and the promise that the stolen data would be deleted. However, the affiliates of the ransomware group claimed that they still had the data and demanded additional payment, leading to a second round of extortion attempts. This resulted in prolonged uncertainty and stress for affected individuals, healthcare providers, and patients, who were left unsure about the security of their sensitive information.

The attack also led to significant disruptions in the healthcare system’s overall functionality. The lack of access to critical systems meant that healthcare providers struggled to deliver services efficiently, and patients faced delays in receiving necessary treatments. The Change Healthcare data breach highlighted the fragility of the healthcare sector’s IT infrastructure, particularly when targeted by well-coordinated cyberattacks.

Information exposed in the Change Healthcare data breach

The data breach exposed a vast amount of personal and healthcare-related information, including:

• Health insurance information: Policy details, member IDs, and Medicaid/Medicare information. This type of data is highly sensitive, as it can be used for fraudulent insurance claims and identity theft.
• Health information: Medical record numbers, diagnoses, treatments, medicines, test results, and care details. Such information is not only sensitive but also deeply personal, and its exposure can have serious implications for individuals’ privacy and well-being.
• Billing and financial information: Claim numbers, payment details, and financial and banking information. Exposure of financial information puts affected individuals at risk of financial fraud and identity theft.
• Personal identifiers: Social Security numbers, driver’s licenses, and passport numbers. These identifiers are critical for establishing an individual’s identity, making their exposure particularly dangerous.

The type of information stolen varied between individuals, and not all affected people had their complete medical history compromised. However, the sheer volume and diversity of the stolen data make this breach one of the most concerning in recent history. The potential misuse of this information poses a significant risk to individuals’ privacy, financial security, and overall well-being.

The February ransomware attack caused significant disruptions in the healthcare system. Doctors, clinics, and pharmacies faced difficulties processing insurance claims, which impacted patients’ access to pre-authorized medications and treatments. Smaller healthcare providers and rural pharmacies were especially affected, with some even facing insolvency due to the halted payments. The inability to process claims and payments in a timely manner led to severe financial strain on these smaller providers, many of whom operate on tight budgets.

The breach also highlighted vulnerabilities in healthcare data security, leading to questions about UnitedHealth’s cybersecurity practices. During a congressional hearing, UnitedHealth CEO Andrew Witty admitted that the Change Healthcare data breach could have been prevented if the company had used multi-factor authentication. Despite spending $300 million annually on cybersecurity, UnitedHealth failed to implement this basic protective measure. This failure not only allowed the attackers to gain access but also raised concerns about the effectiveness of UnitedHealth’s overall cybersecurity strategy.

The Change Healthcare data breachhas also led to increased scrutiny from regulators and lawmakers. The U.S. Department of Health and Human Services (HHS) and other regulatory bodies have launched investigations into UnitedHealth’s cybersecurity practices and their failure to protect sensitive healthcare data. Lawmakers have called for stricter regulations and more stringent requirements for healthcare organizations to ensure that such breaches do not happen again. This incident has sparked a broader conversation about the need for improved cybersecurity standards across the healthcare industry.

What to do?

United Health Group has shared crucial guidance on steps you can take following their recent data breach incident.

1. Enroll in free credit monitoring

• Access free credit monitoring services: United Health Group is offering two years of complimentary credit monitoring and identity protection through IDX. To enroll, click the “Enroll Now” link or call 1-888-846-4705.
• Protect your identity: This service monitors for potential misuse of your information, providing alerts and assistance if any suspicious activity is detected. Coverage is paid for two years by Change Healthcare.

2. Monitor your health and financial records

• Review your health care statements: Regularly check your Explanation of Benefits (EOB) statements and documents from health care providers to spot any unfamiliar or unauthorized services.
• Verify financial statements: Watch your bank and credit card statements, as well as tax records, for any unexpected charges or transactions.
• Report suspicious activities: If you notice any unusual activity, contact your health care provider, insurance plan, or financial institution immediately. In cases of unauthorized activity, file a police report with local law enforcement.

3. Stay informed about the breach

• Check your notification: Change Healthcare has started mailing notifications to individuals affected by the breach. This notification includes specifics on what data may have been compromised. If you believe you’re affected, ensure your contact information is updated with United Health Group.
• Seek support if needed: A dedicated call center (1-866-262-5342) is available to answer questions, provide credit monitoring assistance, and offer emotional support through trained clinicians.

4. Strengthen your financial security

• Order a free credit report: Access your annual credit report from each credit bureau via www.annualcreditreport.com or by calling 877-322-8228. This report helps identify any unfamiliar accounts or credit checks.
• Place a fraud alert: A fraud alert notifies creditors to take extra verification steps before opening new accounts in your name. You can add a fraud alert by contacting one of the credit bureaus:
  • Equifax: 800-525-6285
  • Experian: 888-397-3742
  • TransUnion: 800-680-7289
• Freeze your credit: A security freeze prevents new credit from being opened in your name. Contact each credit bureau to request a freeze:
  • Equifax: 800-525-6285
  • Experian: 888-397-3742
  • TransUnion: 800-680-7289

5. Understand the protections

• Fraud alert vs. security freeze:
  • Fraud alert: Adds a notification to your credit report that you may be a victim of fraud. Creditors must verify your identity before opening new accounts.
  • Security freeze: Prevents creditors from accessing your credit report entirely, blocking new accounts unless you lift the freeze.

Financial impact of the Change Healthcare data breach

The financial impact of the Change Healthcare data breach has been substantial. The February attack resulted in losses of $872 million, which grew to $2.45 billion by the end of September 2024. These costs included accelerated payments and no-interest loans to affected healthcare providers, rebuilding Change Healthcare’s systems, and incident response efforts. The financial burden was not limited to UnitedHealth alone; many healthcare providers who relied on Change Healthcare’s services also faced significant financial strain.

In addition to the direct costs of responding to the breach, UnitedHealth also faced reputational damage. The breach has eroded trust in UnitedHealth’s ability to protect sensitive data, and this loss of trust could have long-term financial implications. Patients and healthcare providers may be hesitant to work with a company that has experienced such a significant security failure, potentially leading to a loss of business and revenue.

The financial impact also extended to affected individuals. Those whose personal and financial information was compromised faced the risk of identity theft and financial fraud. Many individuals had to take steps to protect themselves, such as freezing their credit, monitoring their financial accounts, and being vigilant for signs of identity theft. The cost of these protective measures, both in terms of time and money, added to the overall burden of the breach.

How many people were affected by the breach?

Over 100 million individuals were affected by the Change Healthcare data breach. This makes it one of the largest data breaches of healthcare information in history. The number of affected individuals underscores the scale of the attack and the extensive reach of Change Healthcare’s operations across the United States.

What type of information was stolen?

The stolen data included health insurance details, medical records, billing and payment information, Social Security numbers, and other personal identifiers. Not all individuals had the same types of information compromised, but the diversity of the stolen data means that the potential risks are varied and significant. The exposure of such a wide range of information makes this breach particularly concerning for both individuals and the healthcare sector as a whole.

Who was responsible for the Change Healthcare data breach?

The ransomware attack was carried out by the ALPHV/BlackCat group, a Russian-speaking ransomware gang. After the initial ransom payment, an affiliate of the group formed a new ransomware operation called RansomHub, demanding additional payment from UnitedHealth. This series of events highlights the challenges of dealing with ransomware groups, as even paying the ransom does not guarantee the safety of the stolen data.

#ALPHV scamming affiliates? $22M paid and withdrawn pic.twitter.com/0ocKoXNLme

— 𝕯𝖒𝖎𝖙𝖗𝖞 𝕾𝖒𝖎𝖑𝖞𝖆𝖓𝖊𝖙𝖘 (@ddd1ms) March 4, 2024

What measures has Change Healthcare taken in response to the breach?

Change Healthcare has been working to notify affected individuals and has offered support to consumers and healthcare providers. They have also rebuilt portions of their network and implemented additional security measures. These measures include enhancing their cybersecurity protocols, implementing multi-factor authentication, and conducting a thorough review of their security practices to prevent future incidents. However, the effectiveness of these measures in restoring trust and preventing future breaches remains to be seen.

Could this breach have been prevented?

According to UnitedHealth CEO Andrew Witty, the Change Healthcare data breach could have been prevented if the company had used multi-factor authentication to protect its remote access systems. This highlights a failure to implement basic cybersecurity protocols. The fact that such a simple measure could have prevented one of the largest healthcare data breaches in history underscores the importance of adhering to cybersecurity best practices. It also raises questions about the broader state of cybersecurity in the healthcare industry and the need for more stringent regulations.

What are the long-term consequences of this breach?

The long-term consequences include potential misuse of stolen data for identity theft or further extortion schemes. The Change Healthcare data breach has also led to a loss of trust in UnitedHealth’s ability to secure sensitive health information and has prompted regulatory scrutiny of their cybersecurity practices. Additionally, the breach has sparked a broader conversation about the need for improved cybersecurity standards in the healthcare sector. The long-term impact on individuals, healthcare providers, and the industry as a whole will depend on how effectively UnitedHealth and other stakeholders address these challenges and implement necessary changes.

With over 100 million individuals affected, the fallout from this attack is a reminder of the critical need for better safeguards and accountability in the healthcare sector. The incident has exposed significant vulnerabilities in the way healthcare data is protected and has prompted calls for stronger regulations and more effective security practices.

Ongoing investigations aim to track down those responsible and prevent similar incidents in the future. However, the Change Healthcare data breach has already had far-reaching consequences, affecting millions of individuals, healthcare providers, and the broader healthcare system. The lessons learned from this breach must be used to drive meaningful change in how healthcare data is secured, ensuring that the privacy and security of individuals’ sensitive information are prioritized in an increasingly digital world.

Image credits: Kerem Gülen/Ideogram