- United Healthcare Data breach affected about 190 million people
- The number originally hovered around 100 million
- The majority of victims have already been notified
The number of people affected by the 2024 Change Healthcare Cyberattack is nearly double previous estimates, now sitting at approximately 190 million, the company has admitted.
“Change Healthcare has determined that the estimated total number of individuals affected by the Change Healthcare Cyberattack is approximately 190 million,” said Tyler Mason, a spokesman for UnitedHealth Group.
“The vast majority of these people have already received individual or compensation notices. The final number will be confirmed and filed with the Office for Civil Rights at a later date. “
Alphv and Ransomhub
Hackers would normally misuse this data in phishing attacks, email compromise, wire fraud and other forms of cyberattack, but so far that hasn’t happened, Mason added.
He said the company was: “Not aware of any misuse of individuals’ information as a result of this incident and has not seen electronic medical record databases appear in the data during analysis.”
In this context, it is worth saying that the company paid the demand for the striker.
When Change Healthcare suffered a ransomware attack in early 2024, it was believed that an affiliate of the ALPHV operation was behind the attack. Alhpv, aka Blackcat, was a notorious operator who worked on an as-a-service model, sharing the loot with whoever managed to breach a victim and insert their code.
However, when an affiliate hit health care and managed to blackmail it for $22 million, things changed. Instead of sharing the spoils, Alphv’s operators took it all and disappeared from the face of the earth. The affiliate that was held with gigabytes of sensitive data was later redirected to Ransomhub and became one of the bigger threats.
They demanded a second payment, but it’s unclear if that ever happened. Ransomhub removed Change Healthcare’s entry from its data breach site, suggesting that the victim’s company may have paid it.
Via TechCrunch
