UnitedHealth Says Change Healthcare Hacked by Nation State, as US Pharmacy Outages Drag On 15
U.S. health insurance giant UnitedHealth Group said Thursday in a filing with government regulators that its subsidiary Change Healthcare was compromised likely by government-backed hackers. From a report: In a filing Thursday, UHG blamed the ongoing cybersecurity incident affecting Change Healthcare on suspected nation state hackers but said it had no timeframe for when its systems would be back online. UHG did not attribute the cyberattack to a specific nation or government, or cite what evidence it had to support its claim.
Change Healthcare provides patient billing across the U.S. healthcare system. The company processes billions of healthcare transactions annually and claims it handles around one-in-three U.S. patient records, amounting to around a hundred million Americans. The cyberattack began early Wednesday, according to the company's incident tracker.
Change Healthcare provides patient billing across the U.S. healthcare system. The company processes billions of healthcare transactions annually and claims it handles around one-in-three U.S. patient records, amounting to around a hundred million Americans. The cyberattack began early Wednesday, according to the company's incident tracker.
No, that didn't happen. (Score:1, Funny)
Much like AT&T's non-hack non-DoS "attack" this too is the result of internal incompetence.
It's a lot easier to say "we were hacked by a nation state" than "we couldn't be bothered to
have a decent infrastructure, orderly backups, and access controls to prevent someone from
accidentally deleting stuff."
United Healthcare has been a disaster of a company for the last five years plus. This is no
different.
BTW, UHC, if your lawyers want to sue me for what I wrote here, not to worry. I didn't write it.
A natio
Re: (Score:2)
> not to worry. I didn't write it
Aww, but the discovery would have been so much fun!
I don't believe it either but to steelman their argument, shutting down pharmacies for two days would be the slightest taste of the DC Government's intended war with China, where all of our drug precursors are made.
We have decrepit politicians who stay alive only by the grace of China drugs and those same politicians would seek to cut off that supply.
Normally I would call them morons but CoG probably has enough stockpile
Re: (Score:2)
It's mostly professional-wrestling-level acting in order to create drama.
You really think DC wants to do another world war? Dude, they can't even bring themselves to ship a measly billion dollars worth of munitions over to Ukraine. A war with China would send a coupl
Nothing you said disproved what they said (Score:4, Interesting)
Its still well within the realm of possibility that you are 100% right about the quality of the IT department, and they are also right about the source.
Read up on the PLA's understanding of modern, total war. You can buy a copy translated into English on Amazon here:
https://www.amazon.com/gp/prod... [amazon.com]
You and a lot of /. are hopelessly naive in your takes on China and their allies. Going after targets like UHC is literally part of the PLA doctrine of modern warfare.
Re:Nothing you said disproved what they said (Score:4, Informative)
Like the guarantees Ukraine received [harvard.edu] when it agreed to give up its nuclear weapons? Remind us again how well that has worked out.
Re: (Score:2)
"They've actually been pretty good about honoring [their reasonable guarantees]."
Indeed. Just ask Hong Kong.
Re: (Score:2)
A healthcare company is not an attractive target for anybody except criminals trying extortion.
Keep telling yourself that (Score:2)
UHC is one of the largest health insurance companies in the US. Taking them offline for an extended period of time damages our health care system's billing ecosystem.
If you can't grasp why the Chinese or their allies would do that, you're stuck with your head up your ass on how they believe in waging conflict.
When WWIII finally goes hot, the Chinese will be mass targeting our economy like this. As I said, it's lit
Re: (Score:2)
Not really. The military is after doing real damage. This will just show the target that they need to organize things better, i.e. help them longer term.
Yeah, well, what to say? (Score:5, Insightful)
In any given hacking incident, there are various things to consider:
1. Did the company actually put any effort into IT security? (Many don't, as it's a cost and there's no corresponding return they can put on the balance sheet.)
I would consider effort to mean they'd set their firewall to block everything that wasn't supposed to work from outside, to have put their remote access machines in a DMZ, to have used a hardened distro (be it Linux, FreeBSD, or OpenBSD - Windows does not constitute putting in effort) or to have bought a book on system hardening for the OS they're using, and to have put in effort on security for their Internet-accessible products commensurate to the risk.
2. Did the company keep systems patched?
3. Did the company invest a certain fraction of their income on testing and maintaining security in their own stuff?
You can't expect small shops to invest as much as the big guys, but even they have to invest in IT security. In this case, though, we're not talking about a 2-man startup but a megacorp. They should have been capable of investing a lot.
Yes, you can only invest do much, but it should always be commensurate to the risk. And in a era of heightened international tensions, the risks faced by the well-known megabrands are very high indeed.
It's hard to get any useful data about this case, but it seems like their website was compromised and the payments system taken offline. They're cited a lot in partnership with Microsoft and seem to be using Azure, but it's difficult to know if that's the right company.
However, it likely is. And that's not a combination I'd associate with taking IT security seriously.
Translation (Score:4, Insightful)
"We screwed up so badly that we now need to make the attacker seem to be omnipotent."
Nation states are interested in spying and typically do not do damage. This claim is bogus.
Healthcare IT Security Sucks (Score:2)
IT security in hospitals is notoriously bad. Ultimately, it's driven by the C-level administrators who don't see the value in it, and hire underqualified people - and sometimes just complete idiots - because they're cheap. Often times, at least at the hospital level, these people are considered qualified because they have a CompTIA A+, and maybe a CompTIA Security/Network+, but they don't actually have any idea what the hell they're doing. "Security through obscurity" is a common theme. They don't have the
What Happens (Score:3)
What if someone who ran out of critical Heart medicine cannot get a refile and suffers a bad heard attack (or even dies). Lawyer time ?
In the old days, this would never stop your local Pharmacy from refilling your prescription. They would just write it down and the patient would get what they need. Nothing like having only 2 Pharmacies t go to (for most people).