By Ahmed Aboulenein and Zeba Siddiqui
Washington: hackers who breached UnitedHealth Technology unit in February potentially stole a one third of Americans dataThe longest US health insurerthe CEO told a congressional committee on Wednesday.
Two congressional panels questioned CEO Andrew Witty about the cyberattack on the company. Change health unitwhich processes about 50 percent of everything medical claims In the USA
Non-compliance has caused widespread disturbances in claims processing, impacting patients and suppliers throughout the country.
Witty fielded heated questions from senators on the House Energy and Commerce Committee about the company’s failure to prevent the breach and contain its consequences.
When pressed for details about the compromised data, Witty said “maybe a third” of Americans’ data protected health information and personally identifiable information what was stolen.
“We are continuing to investigate the amount of data involved here,” he added. “We think it’s going to be substantial.”
The AlphV cybercriminal gang hacked Change on February 12 using stolen login credentials on an old server that did not have multi-factor authentication, Witty said.
“It was… a platform that had recently become part of the company and was in the process of being updated,” Witty said, referring to UnitedHealth’s $13 billion acquisition of Change in 2022.
The platform also did not have the security measures prescribed in a joint alert issued by the FBI and US cyber and health officials in December 2023 to specifically warn about AlphV, or BlackCat, targeting healthcare organizations.
UnitedHealth paid the gang about $22 million in bitcoin as ransom, Witty said, adding that, however, there was no guarantee that the breached data was secure and could not be leaked yet. Another hacking group claiming to be an offshoot of AlphV said last month that it had a copy of the data, although the company has not verified that claim.
The Senate Finance panel investigated the enormous influence of UnitedHealth – which has a market capitalization of $445 billion and annual revenue of $372 billion – on American healthcare. But Witty said the company’s problems were not a threat to the broader economy.
Sen. Bill Cassidy said senators on the panel “would have to ask themselves: Is United’s dominant role too dominant because it’s involved in everything and ruining United ruins everyone?”
“What I mean is that the size of United becomes almost too big to fail and sure, because if it fails, it’s going to knock down a lot more than it normally would,” Cassidy said.
Witty responded: “I don’t think it’s because, despite our size, for example, we don’t have hospitals in the United States nor do we own any drug manufacturers.”
However, Change processes medical claims for about 900,000 doctors, 33,000 pharmacies, 5,500 hospitals and 600 laboratories in the US.
US military data was also stolen in the hack, Witty revealed, without saying how many of them were affected.
Senate Finance Committee Chairman Ron Wyden called the attack a national security threat.
“I think the larger the company, the greater the responsibility is to protect their systems from hackers. UHG was a big target long before it was hacked,” he added.
“UnitedHealth Group has not disclosed how many private patient medical records were stolen, how many providers were left without reimbursement, and how many seniors are unable to pick up their prescriptions as a result of the hack,” Wyden said.
In letters to both congressional committees, the American Hospital Association said an internal survey of its members found that 94 percent of hospitals reported damage to cash flow, and more than half reported “significant or serious” financial damage. due to Change’s inability to process claims. .
Similarly, 90 percent of respondents to an American Medical Association survey of doctors said they continue to lose income due to hacking, according to the group’s written testimony before the Senate Finance Committee.
(Reporting by Ahmed Aboulenein, Editing by Nick Zieminski, Chris Sanders and Marguerita Choy)
