Information Technology Security

By Lawrence Abrams,  Bleeping Computer The RansomHub extortion gang has begun leaking what they claim is corporate and patient data stolen from United Health subsidiary Change Healthcare in what has been a long and convoluted extortion process for the company. In February, Change Healthcare suffered a cyberattack that caused massive disruption to the US healthcare system , preventing pharmacies and doctors from billing or sending claims to insurance companies. The attack was ultimately linked to the BlackCat / ALPHV ransomware operation, who later said they stole 6 TB of data during the attack . After facing increased pressure from law enforcement, the BlackCat gang shut down their operation . This occurred amid claims they were pulling an exit scam by stealing a $22 million Change Healthcare ransom payment from the affiliate who conducted the attack. While Change Healthcare has declined to comment on whether it has paid a ransom, the affiliate known as "Notchy" said they ...

By Bill Toulas, Bleeping Computer Optum's Change Healthcare has started to bring systems back online after suffering a crippling BlackCat ransomware attack last month that led to widespread disruption to the US healthcare system. United Health Group (UHG) is the largest American health insurance company, and its subsidiary, Optum Solutions, operates the Change Healthcare platform. Change Healthcare operates the largest payment exchange platform between doctors, pharmacies, healthcare providers, and patients in the US. On February 21, 2024, Optum Solutions suffered a ransomware attack by ALPHV/BlackCat, causing extensive outages after servers were allegedly encrypted and the company shut down its IT systems. These outages led to wide disruption at pharmacies and doctor offices, which could not send claims, causing some patients to pay full price for their medications. Today, UHG released a statement that finally delivered some good news, announcing the electronic prescription syst...

By  Krebs On Security There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group (a.k.a. “ALPHV“) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However, the cybercriminal who claims to have given BlackCat access to Change’s network says the crime gang cheated them out of their share of the ransom, and that they still have the sensitive data Change reportedly paid the group to destroy. Meanwhile, the affiliate’s disclosure appears to have prompted BlackCat to cease operations entirely. In the third week of February, a cyber intrusion at Change Healthcare began shutting down important healthcare services as company systems were taken offline. It soon emerged that BlackCat was behind the attack, which has disrupted the delivery of prescription drugs for hospitals and pharmacies nationwide for nearly t...

By Sergiu Gatlan,  Bleeping Computer The BlackCat/ALPHV ransomware gang has officially claimed responsibility for a cyberattack on Optum , a subsidiary of UnitedHealth Group (UHG), which led to an ongoing outage affecting the Change Healthcare platform . Change Healthcare is the largest payment exchange platform used by more than 70,000 pharmacies across the United States. UHG is the world's largest healthcare company by revenue, employing 440,000 people worldwide and working with over 1.6 million physicians and care professionals in 8,000 hospitals and other care facilities. In a statement published on their dark web leak site today, BlackCat said that they allegedly stole 6TB of data from Change Healthcare's network belonging to "thousands of healthcare providers, insurance providers, pharmacies, etc." "Being inside a production network one can imagine the amount of critical and sensitive data that can be found. The data relates to all Change Health clients tha...

By Sergiu Gatlan,  Bleeping Computer Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks. "ALPHV Blackcat affiliates have been observed primarily targeting the healthcare sector," the joint advisory cautions. Today's warning follows an April 2022 FBI flash alert and another advisory issued in December 2023 detailing the BlackCat cybercrime gang's activity since it surfaced in November 2021 as a suspected rebrand of the DarkSide and BlackMatter ransomware groups. The FBI linked BlackCat to over 60 breaches during its first four months of activity (between November 2021 and March 2022) and said the gang has raked in at least $300 million in ransoms from over 1,000 victims until September 2023. "Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized," the three federal agencies warned in today...

By Zack Whittaker,  Tech Crunch An ongoing cyberattack at U.S. health tech giant Change Healthcare that sparked outages and disruption to hospitals and pharmacies across the U.S. for the past week was caused by ransomware. A healthcare executive with knowledge of the incident, who was on the call briefed by the company’s executives, said the healthcare tech giant attributed the cyberattack to the BlackCat ransomware group . Reuters first reported the news linking the cyberattack to BlackCat, citing two people familiar with the incident. A spokesperson for Change Healthcare did not immediately respond to a request for comment. BlackCat, also often referred to as ALPHV , has not yet publicly claimed responsibility for the cyberattack. Ransomware and extortion gangs typically publish portions of a victim’s stolen data to extort a ransom demand. Ransomware attacks typically scramble a victim’s files and demand a ransom to receive the decryption key. Newer cyberattacks often invol...

By Sergiu Gatlan,  Bleeping Computer Microsoft says BlackCat ransomware affiliates are now attacking Microsoft Exchange servers using exploits targeting unpatched vulnerabilities. In at least one incident that Microsoft's security experts observed, the attackers slowly moved through the victim's network, stealing credentials and exfiltrating information to be used for double extortion. Two weeks after the initial compromise using an unpatched Exchange server as an entry vector, the threat actor deployed BlackCat ransomware payloads across the network via PsExec. "While the common entry vectors for these threat actors include remote desktop applications and compromised credentials, we also saw a threat actor leverage Exchange server vulnerabilities to gain target network access," the Microsoft 365 Defender Threat Intelligence Team said. Although it didn't mention the Exchange vulnerability used for initial access, Microsoft links to a security advisory from March 2...