Day: May 1, 2024
WASHINGTON — Hackers who breached UnitedHealth’s tech unit in February potentially stole a third of Americans’ data, the largest U.S. health insurer’s CEO told a Congressional committee on Wednesday.
Two Congressional panels grilled CEO Andrew Witty about the cyberattack on the company’s Change Healthcare unit, which processes around 50% of all medical claims in the U.S.
The breach has caused widespread disruptions in claims processing, impacting patients and providers across the country.
Witty fielded heated questions from Senators on the House Energy and Commerce Committee about the company’s failure to prevent the breach and contain its fallout.
Pressed for details on the data compromised, Witty said “maybe a third” of Americans’ protected health information and personally identifiable information was stolen.
“We continue to investigate the amount of data involved here,” he added. “We do think it’s going to be substantial.”
The cybercriminal gang AlphV hacked into Change on Feb. 12 using stolen login credentials on an older server that did not have multifactor authentication, Witty said.
“It was … a platform which had only recently become part of the company was in the process of being upgraded,” Witty said, referring to UnitedHealth’s $13 billion acquisition of Change in 2022.
The platform also did not have the security measures prescribed in a joint alert issued by the FBI and U.S. cyber and health officials in December 2023 to specifically warn about AlphV, or BlackCat, targeting healthcare organizations.
UnitedHealth paid the gang around $22 million in bitcoin as ransom, Witty said, adding that however there was no guarantee that the breached data was secure and could not still be leaked. Another hacking group claiming to be an offshoot of AlphV said last month it had a copy of the data, though the company has not verified that claim.
The Senate Finance panel probed the outsized influence of UnitedHealth – which has a market capitalization of $445 billion and annual revenue of $372 billion – on American healthcare. But Witty said the company’s problems were not a threat to the broader economy.
Senator Bill Cassidy said senators on the panel “would have to ask, is the dominant role of United too dominant because it is into everything and messing up United messes up everybody?”
“My point is, the size of United becomes a it’s almost a too big to fail and sure, because if it fails, it’s going to bring down far more than it ordinarily would,” Cassidy said.
Witty said in response, “I don’t believe it is because actually despite our size, for example, we have no hospitals in America, we do not own any drug manufacturers.”
Yet, Change processes medical claims for around 900,000 physicians, 33,000 pharmacies, 5,500 hospitals and 600 laboratories in the U.S.
U.S. military members’ data was also stolen in the hack, Witty revealed, without saying how many of them were impacted.
Senate Finance Committee Chairman Ron Wyden called the hack a national security threat.
“I believe the bigger the company, the bigger the responsibility to protect its systems from hackers. UHG was a big target long before it was hacked,” he added.
“UnitedHealth Group has not revealed how many patients’ private medical records were stolen, how many providers went without reimbursement, and how many seniors are unable to pick up their prescriptions as a result of the hack,” said Wyden.
In letters to both congressional committees, the American Hospital Association said an internal survey of its members found that 94% of hospitals reported damage to cash flow, and more than half reported “significant or serious” financial damage due to Change’s inability to process claims.
Similarly, 90% of respondents to an American Medical Association survey of doctors said they continue to lose revenue because of the hack, according to the group’s written testimony to the Senate Finance Committee.
WASHINGTON — Hackers who breached UnitedHealth’s tech unit in February potentially stole a third of Americans’ data, the largest U.S. health insurer’s CEO told a Congressional committee on Wednesday.
Two Congressional panels grilled CEO Andrew Witty about the cyberattack on the company’s Change Healthcare unit, which processes around 50% of all medical claims in the U.S.
The breach has caused widespread disruptions in claims processing, impacting patients and providers across the country.
Witty fielded heated questions from Senators on the House Energy and Commerce Committee about the company’s failure to prevent the breach and contain its fallout.
Pressed for details on the data compromised, Witty said “maybe a third” of Americans’ protected health information and personally identifiable information was stolen.
“We continue to investigate the amount of data involved here,” he added. “We do think it’s going to be substantial.”
The cybercriminal gang AlphV hacked into Change on Feb. 12 using stolen login credentials on an older server that did not have multifactor authentication, Witty said.
“It was … a platform which had only recently become part of the company was in the process of being upgraded,” Witty said, referring to UnitedHealth’s $13 billion acquisition of Change in 2022.
The platform also did not have the security measures prescribed in a joint alert issued by the FBI and U.S. cyber and health officials in December 2023 to specifically warn about AlphV, or BlackCat, targeting healthcare organizations.
UnitedHealth paid the gang around $22 million in bitcoin as ransom, Witty said, adding that however there was no guarantee that the breached data was secure and could not still be leaked. Another hacking group claiming to be an offshoot of AlphV said last month it had a copy of the data, though the company has not verified that claim.
The Senate Finance panel probed the outsized influence of UnitedHealth – which has a market capitalization of $445 billion and annual revenue of $372 billion – on American healthcare. But Witty said the company’s problems were not a threat to the broader economy.
Senator Bill Cassidy said senators on the panel “would have to ask, is the dominant role of United too dominant because it is into everything and messing up United messes up everybody?”
“My point is, the size of United becomes a it’s almost a too big to fail and sure, because if it fails, it’s going to bring down far more than it ordinarily would,” Cassidy said.
Witty said in response, “I don’t believe it is because actually despite our size, for example, we have no hospitals in America, we do not own any drug manufacturers.”
Yet, Change processes medical claims for around 900,000 physicians, 33,000 pharmacies, 5,500 hospitals and 600 laboratories in the U.S.
U.S. military members’ data was also stolen in the hack, Witty revealed, without saying how many of them were impacted.
Senate Finance Committee Chairman Ron Wyden called the hack a national security threat.
“I believe the bigger the company, the bigger the responsibility to protect its systems from hackers. UHG was a big target long before it was hacked,” he added.
“UnitedHealth Group has not revealed how many patients’ private medical records were stolen, how many providers went without reimbursement, and how many seniors are unable to pick up their prescriptions as a result of the hack,” said Wyden.
In letters to both congressional committees, the American Hospital Association said an internal survey of its members found that 94% of hospitals reported damage to cash flow, and more than half reported “significant or serious” financial damage due to Change’s inability to process claims.
Similarly, 90% of respondents to an American Medical Association survey of doctors said they continue to lose revenue because of the hack, according to the group’s written testimony to the Senate Finance Committee.
Political arrests in Azerbaijan
The decision of the Azerbaijani court to detain Anar Mammadli, the head of the Election Monitoring and Democracy Studies Center (EMDS), will be appealed in the appellate court, according to one of his lawyers, Javad Javadov.
The defense considers Mammadli’s prosecution unjustified. The accusation against him is “abstract.” The basis for Mammadli’s arrest is stated as general allegations that between 2021 and 2024, he imported foreign currency through Baku Airport without customs control. However, it is not specified when, in what amounts, or by what means, says Javadov.
- Gas, water cannons, beatings of tens of thousands of protesters in Tbilisi. How did the night go and what’s next?
- Ruling faction rejects opposition’s border demarcation proposal as ‘dangerous for Armenia’
- Competition for the North-South transport corridor. Perspective from Baku
“Mammadli stated in court that until 2022, he underwent personal customs control upon entry and exit, carrying a maximum of $1,000.
“On the other hand, there is a rigorous control system at the airport. If luggage raises suspicion, it is marked with a red ribbon for inspection.
“There is also a system for checking hand luggage when leaving the airport. Therefore, there are no opportunities for systematic currency smuggling. Thus, there are no material grounds for Mammadli’s arrest,” the lawyer says.
“He also notes that there are no procedural grounds for keeping Mammadli in custody, as he is a well-known figure in society, and no evidence has been presented that he might flee if released.
“As for the searches at Mammadli’s and his father’s apartment, the defense also considers them unjustified. However, nothing illegal was found during the searches.
“Anar Mammadli was detained on April 29 in the Abzas Media case. He is charged under Article 206.3.2 (smuggling by prior agreement of persons) of the Criminal Code. The next day, the court ordered his detention for almost four months.”
International organizations continue to call on the official Baku to release prominent human rights defender and activist Anar Mammadli.
“We demand the immediate and unconditional release of Anar Mammadli,” said a statement from the Norwegian Human Rights House.
The organization demands that the Azerbaijani authorities drop all charges against him, respect international obligations, implement decisions of the European Court of Human Rights on the Mammadli group, end the persecution of independent voices in the country, release all political prisoners, respect the rights of independent civil society and media.
“We call on the UN and the Council of Europe, as well as the European Union, to use COP29 in Baku for this purpose,” the statement said.
In turn, Amnesty International researcher for the South Caucasus, Natali Notadze, on behalf of her organization, also called for the immediate release of Anar Mammadli.
“The authorities must immediately stop the campaign of intimidation against civil society and stop blatantly arresting their critics ahead of COP29 in Baku in November,” she said.
The arrest of Anar Mammadli is indicative of judicial abuses to silence government critics. Illegal searches, restricted access to lawyers, torture and cruel treatment in detention, as well as arbitrary arrests, are an attempt to silence the opposition, she said.
Three rapporteurs of the Council of Europe Parliamentary Assembly (PACE) on Azerbaijan have expressed concern over the arrest of one of the leaders of civil society in Azerbaijan, Anar Mammadli, the Council of Europe’s press service reported.
“Mr. Mammadli is one of the founders of the Election Monitoring and Democracy Studies Center, which conducts independent monitoring of elections in Azerbaijan.
In September 2014, the Parliamentary Assembly of the Council of Europe awarded him the Václav Havel Human Rights Prize,” the statement said by PACE rapporteurs on monitoring Azerbaijan, Lise Christoffersen (Norway) and Ian Liedel-Grainger (UK), as well as the rapporteur on the issue of “Threats to the Lives and Safety of Journalists and Human Rights Defenders in Azerbaijan,” Hannah Bardell.
They noted the need to review Mammadli’s case.
“We are deeply concerned that Mr. Mammadli has been detained again. His lawyer has stated that the detention is related to the case against a number of journalists from Abzas Media and is considered by independent civil society as politically motivated.
We call on the Azerbaijani authorities to immediately review this case and to prevent the criminal prosecution of Mr. Mammadli, whose human rights activities are difficult to overestimate,” the rapporteurs said.
Categories