A cyberattack on a UnitedHealth Group company earlier this year proved costly for one of the country’s major employers.
The health insurance giant reported $872 million in “unfavorable cyberattack effects” in its first-quarter earnings report on Tuesday. Those bad impacts pertain to the February 21 cyberattack on Change Healthcare, which caused hospitals and pharmacies to shut down for over a week. The $872 million includes “the Change Healthcare business disruption impacts and excludes the cyberattack direct response costs,” which most likely excludes any ransom payments UnitedHealth made to hackers.
On the day of the intrusion, UnitedHealth acknowledged that the attackers were members of the ALPHV or BlackCat ransomware gang, which is based in Russia. The organization claimed responsibility for the attack, stating that it stole almost six terabytes of data, including “sensitive” medical records.
UnitedHealth has now revealed how much, if any, it paid the hackers to get their systems restored. However, numerous media sources at the time, including Wired Magazine, reported that BlackCat received a $22 million ransom payment in the form of Bitcoin.
Havoc on healthcare companies
Ransomware assaults, which entail crippling a target’s computer systems and wreaking havoc, are not new and have become increasingly widespread in the healthcare field. According to a report published in JAMA Health Forum in December 2022, the annual incidence of ransomware attacks on hospitals and other providers more than doubled between 2016 and 2021.
Research published in May 2023 in JAMA Network Open that looked at the impacts of an attack on a health system discovered that waiting times, median length of stay, and occurrences of people leaving against medical advice all rose. According to an October 2023 preprint from University of Minnesota researchers, patients in a ransomware-infected hospital had an almost 21% higher fatality rate.
The Change Healthcare incident was “straight out an attack on the U.S. health system and designed to create maximum damage,” CEO Andrew Witty told analysts during an earnings call Tuesday. UnitedHealth expects the incident to cost between $1.35 billion and $1.6 billion this year, according to its earnings report.
Despite the $872 million damage, UnitedHealth Group outperformed first-quarter estimates. UnitedHealth reported $99.8 billion in revenue and a per-share profit of $6.91 in the first quarter of 2024, exceeding FactSet analysts’ expectations of $99.2 billion and $6.61 per share.
“We got through that very well in terms of remediation and building back to (full) function,” Witty went on to say.
During the analysts’ call, Roger Connor, CEO of Optum Insight, stated that approximately 80% of Change Healthcare’s pharmacy claims and payment computer systems had been fully restored following the cyberattack.