Change Healthcare outage likely caused by ransomware group Blackcat

In an incident update regarding their recent outage, the UnitedHealth unit said that, “On February 21, Change Healthcare began experiencing a cyber security issue. Once they became aware of the outside threat, and in the interest of protecting their partners and patients, they took immediate action to disconnect their systems to prevent further impact. Their experts and third-party cybersecurity vendors are working closely with law enforcement to address the matter… As is usual in any cybersecurity incident, Change Healthcare is not providing much detail about the specifics of the attack. In a regulatory filing, UnitedHealth Group reported believing a ‘nation-state associated threat actor’ gained access to their information technology systems. It is now believed that this attack is related to the ALPHV/Blackcat Ransomware-as-a-Service. It is not known if any data was exfiltrated from affected technology systems, though forensic experts and law enforcement agencies have been engaged to determine the scope of the issue. Change Healthcare is using multiple approaches to restore services in a safe and secure manner. They have reported that they are focusing on systems directly impacting patient care first, such as those related to e-prescribing and imaging. They are acutely aware of the impact of delays on the revenue cycle and will bring those systems online as soon as possible. As of Sunday (2/25), they expect to have more information on a timeline for claims, ERA, and eligibility service restorations on Tuesday (2/27).”