HEALTH Yay work made the news: Tens of thousands of pharmacies across America unable to get prescriptions to patients after major cyberattack

Repairman-Jack

Veteran Member
2 1/2 weeks later (approx) they're back online:


UnitedHealth brings some Change Healthcare pharmacy services back online

Optum's Change Healthcare has started to bring systems back online after suffering a crippling BlackCat ransomware attack last month that led to widespread disruption to the US healthcare system.


United Health Group (UHG) is the largest American health insurance company, and its subsidiary, Optum Solutions, operates the Change Healthcare platform. Change Healthcare operates the largest payment exchange platform between doctors, pharmacies, healthcare providers, and patients in the US.


On February 21, 2024, Optum Solutions suffered a ransomware attack by ALPHV/BlackCat, causing extensive outages after servers were allegedly encrypted and the company shut down its IT systems.


These outages led to wide disruption at pharmacies and doctor offices, which could not send claims, causing some patients to pay full price for their medications.


Today, UHG emailed a statement to BleepingComputer that finally delivered some good news, announcing the electronic prescription systems are back online and fully functional as of March 7.


"Electronic prescribing is now fully functional with claim submission and payment transmission also available as of March 7," reads the status update.


"We have taken action to make sure patients can access their medicines in the meantime, including Optum Rx pharmacies sending members their medications based on the date needed."


The company also promised that the electronic payments platform should gradually return to normal operational status starting on March 15, while the work to re-establish the medical claims system will begin with testing on March 18, 2024.


Currently, interim solutions are in place to process medical claims, achieving a throughput of 90%. This figure is expected to rise to as much as 95% by next week, following the implementation of additional solutions by UHG.


The company strongly advises all stakeholders to implement the available workarounds until the systems are fully restored and maintain them post-restoration for redundancy. Date estimates are dubious, and system availability may not be stable for a certain period.


For specific system statuses, check this status page on the Change Healthcare platform. Updates on status changes are provided through this webpage.


At the start of the month, Optum launched a temporary funding assistance program to allow healthcare providers to continue operating without facing monetary shortages for as long as the payment systems are down.


On Tuesday, March 5, the U.S. Department of Health and Human Services announced further measures to lessen the impact of the outage for impacted organizations.


However, the American Hospital Association responded with a request for more action, calling the incident "the most significant and consequential incident of its kind against the U.S. health care system in history."


Ransom allegedly paid​


Last week, an affiliate for the BlackCat gang claimed that the ransomware operation stole a $22 million ransom payment from them, which was paid by Optum to prevent the leak of 6 TB of allegedly stolen data and to receive a file decryptor.


The ransomware operation shut down their servers and soon announced the shutdown of the entire operation, which many believe was a planned exit scam.


Unfortunately, the affiliate behind the Optum attack claims to have the stolen Change Healthcare data still and will likely continue to extort the company to pay another ransom.


However, if a ransom was paid, it means Change Healthcare gained access to a decryptor, allowing the company to restore systems and servers more quickly.
 

Knoxville's Joker

Has No Life - Lives on TB
Optum is losing out in tons of money as folks look for other providers in the near future that are not so prone to security issues unless they can assure that this will never happen again. Not to mention the fact most places shut any connection to/from them the moment this occurs.
 

Tex88

Veteran Member
There was an update from management. The update is: most CHC systems are still not yet back in operation.

Hesus…

Full text of message from HQ:

Dear Colleagues,

As most of you are well aware, Change Healthcare (CHC), a healthcare technology company that is part of Optum and owned by UnitedHealth Group, announced Feb. 21 that it had experienced a cybersecurity incident that impacted its network and operations and disrupted a number of its systems and services that are utilized by numerous healthcare institutions and providers, including blah/blah.

As a result, some of the blah/blah and provider EMR interfaces and billing systems utilized by blah/blah laboratories/pathology practices were interrupted, and as of the time of this communication, most CHC systems are still not yet back in operation.

blah/blah Leadership and Cybersecurity Department continue to actively monitor industry communications about the impact of this event on the healthcare ecosystem, and we are working diligently to consider and engage various solutions to address or remediate the disruptions.

blah/blah Division leadership has been provided FAQs to assist with addressing incoming inquiries from clients, customers and patients on CHC’s cybersecurity issue and its impact to blah/blah operations and services. Please continue to utilize the FAQs, and direct any questions to your Division’s leadership, accordingly. As always, patient care at our practices remains blah/blah highest priority.

We will continue to keep you apprised of significant developments in real time, and thank you for your continued patience and understanding in working through this matter.
 
Last edited:

colonel holman

Veteran Member
Meanwhile, every private clinic of any kind that bills to insurance plans or Medicare… has lost all cash flow, unprocessed billing, and thus far all ongoing and future billing abilities. Many clinics run razor-thin profits needed to weather any mild brief interruption in income. This event is way bigger and ongoing for most to survive.

This was/is a HUGE vulnerability to the entire healthcare system for the entire country, whereby everyone’s billing and their attached medical records flows through ONE clearinghouse that processes these data to pipe into all the payers. HUGE vulnerable link in that chain
 
Last edited:

Reasonable Rascal

Veteran Member
What Col. Holman said above is a warning. If you are not as prepped as you can be, and the system breaks down entirely you may perish without care simply because some bad actor wanted your doctor's money and didn't care about ramifications. If the doc can't eat, they aren't going to report to work bright and shiny anyhow until they starve.

RR
 

Tex88

Veteran Member
Oh fer fuxake!!

Another ransomware group is seeking a payout from Change Healthcare, according to cybersecurity analysts​


By Paige Minemyer
Apr 8, 2024 12:15pm



UPDATED: April 8 at 12:34 p.m.
After the hackers responsible for the cyberattack on Change Healthcare took the ransom and ran in a reported exit scam, cybersecurity experts have found a new post that is seeking a payout from UnitedHealth Group to recover the data.
A post from RansomHub claims to have four terabytes of data stolen from Change, according to analyst Dominic Alvieri. The listing alleges that the administration of BlackCat, or ALPHV, stole a $22 million ransom payment made to recover the data.
Neither UnitedHealth nor Optum have confirmed that the payment was made, but researchers have identified payment logs that suggest the money changed hands.
"ALPHV stole the ransom payment...that Change Healthcare and United Health payed [sic] in order to restore their systems and prevent the data leak," according to the post. "HOWEVER we have the data and not ALPHV."
Alvieri posits in a LinkedIn post that either RansomHub acquired the ALPHV affiliate who conducted the actual hacking, or that this is an "entry scam" in an attempt to extort UnitedHealth for additional cash. As ALPHV operates as a ransomware-as-a-service (RaaS) entity, they make the software available to affiliates who do the actual hacking. Each then receives a cut of any ransom payouts.
The post claims that the large tranche of data includes medical records, payment information, personal details such as Social Security numbers and source code files for Change Healthcare's platforms. It also says that impacted parties include Medicare, CVS Health, MetLife and many other insurance companies.
Change Healthcare is currently in the process of analyzing the data that was impacted, and determining who may need to be notified that their information was accessed. Experts say this could be a messy process.

 

LoupGarou

Ancient Fuzzball
The interesting thing is that most of the RaaS (Ransomware as a Service) "groups" have a "help desk" that can come into play and "help" the victims, sometimes for free if the original users of their service have done things like this (or if the victim is not "big enough" to warrant collecting a large ransom).

My issue is why don't these companies like these have one or two LOCAL Image backups in place that are at LEAST one once a day, that way if they get hit, they have an image of their servers to go back to? Even if you believe that Cloud backups are the way to go (may want to think that strategy if it's your only backup, just sayin'), having a LOCAL Image backup is worth it's weight in gold. Drive space is cheap, even SSD drive space. Image backups are built in to most OSs, especially server OSs. Linux has rsync and others. M$ Windows has WBADMIN. There are no reasons not to have a local image backup.
 

Tex88

Veteran Member
The interesting thing is that most of the RaaS (Ransomware as a Service) "groups" have a "help desk" that can come into play and "help" the victims, sometimes for free if the original users of their service have done things like this (or if the victim is not "big enough" to warrant collecting a large ransom).

My issue is why don't these companies like these have one or two LOCAL Image backups in place that are at LEAST one once a day, that way if they get hit, they have an image of their servers to go back to? Even if you believe that Cloud backups are the way to go (may want to think that strategy if it's your only backup, just sayin'), having a LOCAL Image backup is worth it's weight in gold. Drive space is cheap, even SSD drive space. Image backups are built in to most OSs, especially server OSs. Linux has rsync and others. M$ Windows has WBADMIN. There are no reasons not to have a local image backup.
Everything is decided by penny pinchers and butt kissers who got promoted beyond their skillset.
 

SmithJ

Veteran Member
Most people rotate their backup disks and the ransomware lays dormant until all backups are infected.
 

et2

Has No Life - Lives on TB
My company web site and e-commerce has was cyber hacked back in late October. Ransom wasn’t paid.

It’s still down for the most part. Nobody is saying the financial loss. It’s huge. It was a strategic attack by terrorist supporters of Hammas and Palestine.

Rebuilding the site
 
Top