UnitedHealth $UNH Group, the parent company of the largest health insurer in the U.S., confirmed this week that it paid a ransom in relation to a cyberattack on its subsidiary Change Healthcare earlier this year.
The company said that the compromised data "could cover a substantial portion of people in America"
UnitedHealth $UNH Group, the parent company of the largest health insurer in the U.S., confirmed this week that it paid a ransom in relation to a cyberattack on its subsidiary Change Healthcare earlier this year.
“A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure,” a United spokesperson told Quartz and other media outlets in an emailed statement. The company did not disclose details on the amount of the ransom.
In February, the ransomware group ALPHV breached Change Healthcare, a record and payment manager, resulting in delayed prescriptions and paychecks for healthcare workers. Change processes 14 billion transactions a year, about 6% of all payment in the U.S. health care system.
United said in an update on Monday that a preliminary review of targeted data found files that contained protected health information and personally identifiable information, “which could cover a substantial portion of people in America.”
“We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it,” UnitedHealth Group CEO Andrew Witty said in the update.
The company also said that it found 22 screenshots, allegedly from the breach, on the dark web. To date, none of the files have included doctors’ charts or full medical histories. No additional files have been found uploaded online.
According to the update, it will take the company several months to complete its review and notify everyone that was impacted.
In the meantime, the company has launched a website for resources and a call center for those affected to request two years of free credit monitoring and identity theft protections.
The update also noted that Change pharmacy services are now back to normal levels and payment processing has reach 86% of pre-attack levels.
United reported better than expected revenue earlier this month in its first quarterly earnings report since the attack. The company’s revenue was up 8% year-over-year to $99.7 billion in the first quarter, from $92 billion. This was slightly above Wall Street expectations of $99.2 billion.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.