Blackcat ransomware gang reportedly behind Change cyberattack

Photo: Andrew Brookes/Getty Images

The Blackcat ransomware gang is behind the Change Healthcare cybersecurity attack last week that has affected prescription deliveries, according to Reuters.

Hackers gained access to Change Healthcare's information technology systems in a cyberattack first reported on February 21.

Alphabet's cybersecurity unit Mandiant is handling the investigation into the breach, the Reuters report said. Mandiant confirmed it has been engaged in support of the incident response.

UnitedHealth Group, parent company of Optum, did not confirm the ransomware report but by statement said, "We also continue to work closely with law enforcement and a number of third parties, including Mandiant and Palo Alto Networks, on this attack against Change Healthcare's systems."

WHY THIS MATTERS

After the cyberattack was discovered, Change disconnected its systems, which has affected provider operations, particularly for pharmacy services.

Change offers payment and revenue cycle management services.

The American Hospital Association sent out a cybersecurity advisory on February 22 advising healthcare systems to disconnect from Optum to avoid any "disruptive effects on revenue cycle."

The AHA did not respond to a request for comment on how or if the cyberattack has affected hospital revenue cycle operations but on its website told hospitals, "When considering connectivity to nonimpacted Change Healthcare systems, each healthcare organization should weigh connection or reconnection against possible business and clinical disruptions caused by severing the connection to nonimpacted Change Healthcare systems. In addition, we recognize that the hospitals and health systems may be experiencing challenges with obtaining care authorizations for their patients, as well as delays in payment."

UnitedHealth Group said by statement Tuesday, "We understand the impact this issue has had on claims for payers and providers. Any delays to claims processing have yet to impact provider cash flows as payers typically pay one to two weeks after processing. As we work on bringing systems back online, we are also developing solutions to that challenge if needed."

The attack is affecting pharmacies and reportedly pharmacy services, such as prior authorization.

TRICARE, the healthcare program for service members, said it has been impacted. 

"A reported cyberattack on the nation's largest commercial prescription processor, Change Healthcare, has affected military clinics and hospitals worldwide," TRICARE said. "On Feb. 21, Change Healthcare disconnected their systems to protect patient information. This is impacting all military pharmacies worldwide and some retail pharmacies nationally."

Military clinics and hospitals are providing outpatient prescriptions through a manual procedure, TRICARE said.

UnitedHealth Group said in its statement that more than 90% of the nation's pharmacies have set up electronic workarounds.

"As we remediate, the most impacted partners are those who have disconnected from our systems and/or have not chosen to execute workarounds," UHG said.

United Health said it estimates more than 90% of the nation's 70,000 plus pharmacies have modified electronic claim processing to mitigate impacts from the Change Healthcare cyber security issue. The remainder have offline processing workarounds.

Hospitals, health systems and providers have connections to multiple clearinghouses and access manual workarounds, UHG said.

Both Optum Rx and UnitedHealthcare are seeing minimal reports, including less than 100 out of more than 65 million pharmacy benefit management members not being able to get their prescriptions. Those patients have been immediately escalated and we have no reports of continuity of care issues, UHG said.

THE LARGER TREND

The American Hospital Association on February 26 issued an updated cybersecurity advisory highlighting updates on network connectivity issues and indicators of compromise related to the cyberattack on Change Healthcare. 

The AHA said the advisory contains information from a February 26 Bulletin issued by the Health Information Sharing and Analysis Center (Health-ISAC), with which the AHA works. 

"Members should prioritize this bulletin as it contains actionable indicators of compromise that should be loaded into network defenses as soon as possible," said John Riggi, AHA's national advisor for cybersecurity and risk. "The alert also contains network connectivity guidance based on statements provided by Change Healthcare. We must remember that Change Healthcare is a victim of a cyberattack from an apparent foreign-based cyber adversary. This attack is not only on Change Healthcare but is an attack on the entire healthcare sector that depends upon the availability of Change Healthcare's services and technology." 

As of February 23, Change Healthcare began including the following statement in its regular updates, "We have a high-level of confidence that Optum, UnitedHealthcare and UnitedHealth Group systems have not been affected by this issue."

Email the writer: SMorse@himss.org