Change Healthcare Security Incident

Skip to site content Articles Managing Vendor Risk: Lessons Learned After the Change Healthcare Breach Back to all articles The healthcare sector was dealt another blow on February 21, 2024, when Change Healthcare, a division of Optum and a subsidiary of UnitedHealth Group Incorporated, fell victim to a cyberattack. The company disclosed that the attack compromised customer data and disrupted operations, leading to a shutdown of customer-facing services. This interruption had a significant ripple effect, affecting an estimated one-third of all medical transactions in the U.S. [1] , highlighting the critical role Change Healthcare plays in the nations healthcare infrastructure. Many medical practices were unable to process claims, verify insurance eligibility, access patient records, and conduct routine billing. As a result, the disruption caused lost income and forced some offices to temporarily close. This incident raises many questions regarding Change Healthcares security practices and how an organization can protect itself from the same fate. This article highlights a crucial lesson about the risks of vendor dependency in the healthcare sector. What Happened Change Healthcare fell victim to a Russian-linked hacking group named BlackCat known for its expertise in ransomware attacks. The group exploited a vulnerability in a product called ConnectWise to infiltrate Change Healthcare's systems. Upon gaining access, they exfiltrated 6 terabytes of data containing protected health information (PHI) then launched a ransomware attack locking the company out of their systems [2] . Immediately following the detection of the incident, Change Healthcare initiated a shutdown of systems and services to contain the attack and prevent further spreading of the ransomware. The result of the massive shutdown left healthcare organizations helpless as they lost access to Change Healthcare services upon which they depended. Furthermore, these organizations were left in the dark...

... (truncated for display)