UnitedHealth Group Faces $872 Million in Costs After Cyberattack on Subsidiary

UnitedHealth Group, one of the nation’s largest employers, faced a costly setback earlier this year due to a cyberattack on its subsidiary, Change Healthcare. The attack, which occurred on February 21, resulted in $872 million in “unfavorable cyberattack effects” for UnitedHealth in its first-quarter earnings report. This amount excludes any potential ransom paid to the hackers.

The cybercriminals behind the attack were identified as the Russia-based ransomware gang ALPHV or BlackCat, who claimed responsibility for stealing sensitive medical records totaling over six terabytes. Reports suggested that a ransom payment of $22 million in bitcoin was made to BlackCat to restore the systems.

Ransomware attacks have become increasingly common in the healthcare industry, causing significant disruptions. A study found that the number of attacks on hospitals doubled from 2016 to 2021. The impact of such attacks on health systems includes increased waiting times, patient mortality rates, and incidents of patients leaving against medical advice.

Despite the financial hit from the cyberattack, UnitedHealth Group exceeded first-quarter expectations with $99.8 billion in revenue and a per-share profit of $6.91. CEO Andrew Witty described the incident as an attack on the U.S. health system designed for maximum damage. The company projects a total cost of $1.35 billion to $1.6 billion for the year due to the cyberattack.

Efforts to restore operations are underway, with 80% of Change Healthcare’s pharmacy claims and payment systems already restored. The incident serves as a reminder of the growing threat of cyberattacks in the healthcare sector and the importance of robust cybersecurity measures.