Change Healthcare Security Incident

Fraud Management & Cybercrime , Healthcare , Industry Specific BlackCat Pounces on Health Sector After Federal Takedown Feds Issue Alert as Change Healthcare Hack Affects Medicare, CVS Caremark, MetLife Marianne Kolbasuk McGee ( HealthInfoSec ) February 28, 2024 Credit Eligible Get Permission U.S. authorities have been trying to shut down the BlackCat ransomware-as-a-service group for over a year. The relatively young group, also known as Alphv, has built a notorious reputation, grabbing headlines in March 2023 when it leaked stolen photos of breast cancer patients in an extortion attempt against a group of Pennsylvania cancer clinics. See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach. The FBI, posing as an affiliate, infiltrated the ransomware group's operation and developed a tool that could decrypt the systems of more than 500 BlackCat victims. Then, agents in December seized the group's data leak site and its Tox peer-to-peer instant messaging account - though the leak site was back in BlackCat's control within a week (see: FBI Seizes BlackCat Infrastructure, Group Has New Domain ). In retaliation for the attempted takedown, federal authorities say the BlackCat administrator posted a note "encouraging its affiliates to target hospitals." On Wednesday, the Russian-speaking group claimed on its dark web site that it is behind the biggest healthcare hack so far the year - exfiltrating 6 terabytes of "highly selective data" relating to "all" Change Healthcare clients, including Tricare , Medicare, CVS Caremark, MetLife, Loomis, Davis Vision, Health Net, Teachers Health Trusts "and tens of insurance and other companies." (See: Change Healthcare Outage Hits Military Pharmacies Worldwide ). On Thursday, Optum confirmed in a statement that the attack on its IT services unit, Change Healthcare, had been perpetrated by cybercriminals claiming to be BlackCat/Alphv.* A joint warning from...

... (truncated for display)