UnitedHealth CEO Andrew Whitty admits he paid hackers a $22 million ransom

Medical insurance supplier UnitedHealth paid a multimillion-dollar ransom to hackers who broke into considered one of his subsidiariesdisrupting well being care suppliers throughout the nation for months, CEO Andrew Whitty confirmed Wednesday.

At a Senate Finance Committee listening to, Whitty mentioned the choice to pay the $22 million ransom was fully his choice. “It was one of many hardest choices I’ve ever needed to make,” he mentioned. UnitedHealth arrived final month that the corporate paid a ransom to hackers who hacked UnitedHealth’s Change Healthcare system, however didn’t disclose the quantity. In March the corporate attributed the violation to BlackCat, the identical group accountable for the hack of the MGM on line casino in Las Vegas. In the identical month Wired reported that BlackCat, also referred to as ALPHV, obtained a $22 million Bitcoin transaction on March 1st.

BlackCat beforehand claimed to have obtained greater than six terabytes of knowledge in a hack carried out in February this 12 months. The ransomware gang mentioned the info included “delicate” medical information. based on CBS Information.

“The criminals used the compromised credentials to remotely entry the Change Healthcare Citrix portal, an utility used to supply distant entry to desktops,” Whitty mentioned throughout his testimony, including that the portal “doesn’t have multi-factor authentication.”

“This hack might have been stopped with a Cybersecurity 101 program,” mentioned Sen. Ron Wyden (D-Ore.), the committee chairman. After Whitty confirmed United would require multi-factor authentication company-wide sooner or later, Wyden mentioned it was “not well worth the worst cyberattack ever within the healthcare sector to agree to do that minimal.”

The results of the hack had been far-reaching. After the breach was found, United shut down Change Healthcare for every week, leaving hospitals, clinics and pharmacies throughout the nation unable to obtain cost. In the course of the listening to, Whitty mentioned the system was now “typically again to regular.” However some senators informed Whitty that hospitals and different well being care suppliers are nonetheless ready for funds. Wyden (D-Ore.) informed Whitty that some well being care suppliers who filed claims in February had been informed they must wait till June to receives a commission.

The corporate manages greater than one-third of all affected person information within the U.S. and oversees one in 10 docs nationwide, based on UnitedHealth. letter The American Hospital Affiliation despatched a letter to the Division of Well being and Human Companies in March. In his opening remarks, Wyden known as United a “well being care leviathan” and described the hack as “a dire warning in regards to the penalties of megacorporations which can be too massive to fail.”