Change Healthcare attack affected 100 million Individuals

UnitedHealth Group has disclosed that over 100 million individuals had their sensitive data compromised as a result of the February attack by the now-defunct BlackCat ransomware operation against its subsidiary Change Healthcare, making the incident the largest U.S. healthcare data breach.

Investigation into the incident revealed that infiltration of Change Healthcare’s employee systems through stolen credentials without multi-factor authentication enabled the eventual compromise of the firm’s network with ransomware, resulting in network disruptions till date and the company finding difficult to restore its part of the network.

Through the payment of a $22 million ransom confirmed the exfiltration of individuals’ names, birthdates, addresses, Social Security numbers, diagnoses, imaging and care treatment plans, and financial and banking information, among others.

The ransomware attack and data breach at Change Healthcare stands as the largest known digital theft of the U.S. medical records, and one of the biggest data breaches in recent times. Millions of Americans whose private medical information was irretrievably stolen.

The U.S. Department of Health and Human Services first reported the updated number on its data breach portal, and United Healthcare notified the affected customers between July and October of this year.