A third of Americans may have had their personal data swept up in a February ransomware attack on a UnitedHealth Group subsidiary that disrupted pharmacies across the US, UnitedHealth CEO Andrew Witty estimated in testimony to Congress on Wednesday.
It will likely take “several months” before UnitedHealth is able to identify and notify Americans impacted by the hack because the company is still combing through the stolen data, Witty said in written testimony.
In hours of hearings in the Senate and House Wednesday, Witty apologized to patients and doctors, admitted that hackers broke into the subsidiary through a poorly protected computer server and confirmed that he authorized a $22 million ransom payment to the hackers.
The testimony shows that the scope of what experts consider to be the most significant health care cyberattack in US history is even bigger than previously known. And the hacking incident has led some lawmakers to call for cybersecurity regulations for health care companies.
The February ransomware attack paralyzed computers that Change Healthcare, the UnitedHealth subsidiary, uses to process medical claims across the country. Health providers were cut off from billions of dollars in payments, according to one hospital association, and some health clinics told CNN they were close to running out of money. The Department of Health and Human Services is investigating whether UnitedHealth complied with federal law in protecting patient data.
More than two months since the ransomware attack, Witty touted the company’s recovery by rebuilding computer systems and getting insurance claims flowing to “near-normal” levels. But, he said the process for identifying and notifying Americans affected by the hack was cumbersome partly because data files were compromised in the incident.
In the hearing, multiple lawmakers asked if UnitedHealth and Change Healthcare, which processes about 15 billion health care transactions annually, controlled an outsized portion of the US health sector, leaving the sector vulnerable to hacks and other disruptions.
“Your revenues are bigger than some countries’ GDP,” Sen. Marsha Blackburn, a Tennessee Republican, told Witty. “And how in heaven’s name did you not have the necessary redundancies so that you did not experience this attack and find yourself so vulnerable?”
UnitedHealth has blamed its hack on a notorious criminal group called ALPHV, or BlackCat, that the Justice Department says has been responsible for ransomware attacks on victims around the world.
The FBI generally discourages victims to pay a ransom because it can fuel more ransomware attacks. But UnitedHealth is one of multiple major US firms that have made multimillion-dollar ransom payments to try to recover stolen data or get systems back online. Colonial Pipeline, a pipeline operator that transports fuel to the East Coast, paid a $4.4 million ransom in 2021 after a Russian-speaking ransomware group disrupted the pipeline operations for days.
UnitedHealth has said it paid the ransom “as part of the company’s commitment to do all it could to protect patient data from disclosure.”
But lawmakers on Wednesday said they would keep the pressure on the company to get to the bottom of what personal health information was accessed.
“Americans are still in the dark about how much of their sensitive information was stolen,” Sen. Ron Wyden, an Oregon Democrat who chairs the finance committee, lamented.
