A severe ransomware attack against Change Healthcare in February delayed prescription orders across the United States and continues to have severe consequences.
Cybercriminal group RansomHub has released some of the millions of patient records it claims to have stolen in attacks on the dark web, including medical information, insurance records and billing details.
RansomHub claims that unless Change Healthcare pays the ransom, 4TB of stolen data will be sold to the highest bidder. The shipment is also said to contain contracts and legal agreements between Change Healthcare and its business partners.
To further complicate the situation, RansomHub is not the first cybercriminal group to claim responsibility for the devastating Change Healthcare hack.
The ransomware attack was initially attributed to the BlackCat ransomware gang, also known as ALPHV. In fact, BlackCat/ALPHV reportedly received the equivalent of $22 million in cryptocurrency payments in early March, which was widely believed to be a ransom.
If this is accurate, why does another cybercriminal group now appear to be demanding a ransom from Change Healthcare? Is this a single breach, or two different groups trying to extort money from the same theft?
The security breach may be linked to two different groups, as affiliates and members of the ransomware gang have feuded over how best to divide the proceeds.
RansomHub says wired It is not affiliated with the BlackCat/ALPHV group and declined to disclose the ransom amount demanded from Change Healthcare.
Regardless of who stole what, and how much ransom they might demand, selling the leaked information significantly increases the risk to patients and the industry as a whole.
Patients now find themselves at increased risk of identity theft and financial fraud, and may be subject to discrimination based on compromised medical information. At the same time, insurers are concerned there could be a significant increase in fraudulent claims, which in turn would increase costs for consumers.
None of this is good news, and raises an interesting question – how will Change Healthcare respond to the latest ransom demand?
Change Healthcare’s parent company, UnitedHealth Group, said the company continues to “make progress in mitigating the impact of February’s cyberattack.”
