Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak

For Change Healthcare and the healthcare facilities, hospitals and patients that depend on it, the confirmation of extortion payments to hackers added a bitter finale to an already dark story. AlphV's digital paralysis of Change Healthcare, a subsidiary of UnitedHealth Group, has hindered insurance approvals for prescriptions and medical procedures for hundreds of medical facilities and hospitals across the country. water, making it the most widespread medical ransomware disruption ever by some measures. A survey of American Medical Association members, conducted between March 26 and April 3, found that four in five clinicians had lost revenue due to the crisis. Many said they are using their personal finances to cover practice costs. Meanwhile, Change Healthcare said that they lost $872 million because of this incident and it's expected that number will grow to more than a billion in the long term.

Now, Change Healthcare's confirmation of the ransom payment appears to suggest that much of the dire consequences for the US healthcare system have already taken place. Later they paid the hackers an exorbitant sum of money – a payment in exchange for decryption keys for the systems the hackers had encrypted and a promise not to leak the company's stolen data. As often happens in ransomware attacks, the disruption to AlphV's systems appears to have been so widespread that Change Healthcare's recovery process lasted long after the company received the decryption key it designed. designed to unlock your system.

As ransomware payments continue, $22 million would not be the largest amount of money a victim has spent. But it was close, said Brett Callow, a security researcher focusing on ransomware who spoke to WIRED about the suspected payment in March. Only a few rare payments, such as the $40 million CNA Financial paid to hackers in 2021, topped that figure. “It's not unprecedented, but it's certainly very unusual,” Callow said of the $22 million figure.

The $22 million pumped into the ransomware ecosystem further fueled a vicious cycle that spread. Cryptocurrency tracing firm Chainalysis finds that in 2023, ransomware victims paid hackers to target them 1.1 billion USD, a new record. Change Healthcare's payout is likely to be just a small portion of that amount. But it both rewards AlphV for its highly destructive attacks and may suggest to other ransomware groups that healthcare companies are especially lucrative targets, as these companies are especially sensitive. sensitive to both the high financial costs of such cyberattacks and the risks they pose to patients' health.

Change Healthcare's complex chaos is clearly a double-cross in the underworld of ransomware: AlphV appears to have faked its own law enforcement takedown after receiving Change's payment Healthcare aims to avoid sharing it with its so-called affiliates, hackers who work with the group to infiltrate victims on their behalf. The second ransomware group that threatened ChangeHealthcare, RansomHub, now claims to WIRED that it obtained stolen data from those affiliates, who still want to be paid for their work.

That created a situation in which Change Healthcare's payment provided little assurance that the compromised data would not be exploited by disgruntled hackers. “These branches work for many groups. They're worried about getting paid themselves, and there's no trust among the thieves,” Analyst1's DiMaggio told WIRED in March. “If someone defrauds someone else, you don't know what they're going to do. with data.”

All of which means that Change Healthcare still has some assurance that it will avoid a situation even worse than what it has already faced: paying what could be one of the largest ransoms ever in history and still see my data being spilled onto the dark web. “If it leaks after they pay $22 million, it's almost like burning that money,” DiMaggio warned in March. “They will burn that money for nothing.”