UnitedHealth Group has paid an undisclosed ransom to hackers in an try and retain affected person information that will have been compromised.
The assault, which occurred in February, affected sufferers of Change Healthcare, a division of United’s Optum.
“This assault was performed by malicious risk actors, and we proceed to work with legislation enforcement and a number of main cyber safety corporations throughout our investigation,” a UnitedHealth rep informed CNBC. “A ransom was paid as a part of the corporate’s dedication to do all it might to guard affected person information from disclosure.”
Associated: A Cyberattack on the Largest Well being Insurer within the U.S. Might Put Your Prescriptions and Private Information at Threat
UnitedHealth revealed that the hacked recordsdata contained protected well being info and personally identifiable info to “a considerable proportion of individuals in America,” although the corporate didn’t disclose precisely what number of sufferers have been affected.
Thus far, UnitedHealth mentioned there was no proof of knowledge being exfiltrated for use maliciously, and medical doctors’ charts and medical histories don’t appear to be a part of the hacked information set.
“We all know this assault has precipitated concern and been disruptive for customers and suppliers, and we’re dedicated to doing all the pieces potential to assist and supply assist to anybody who might have it,” mentioned Andrew Witty, CEO of UnitedHealth Group, in an organization launch.
UnitedHealth estimates it’ll take a number of months of study to find out the precise people affected by the hack, however 22 screenshots from what seemed to be exfiltrated recordsdata containing Persona Well being Info (PHI) and Private Identifiable Info (PII) have been posted on the darkish net for per week.
Associated: Maine Hacked in Information Breach, 1.3 Million Residents At Threat
The corporate is providing two years of free entry to a devoted name middle for credit score monitoring and id theft safety to these impacted.
“Whereas this complete information evaluation is performed, the corporate is in communication with legislation enforcement and regulators and can present applicable notifications when the corporate can affirm the data concerned,” UnitedHealth mentioned.
