{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T23:13:41.393Z", "tag": { "id": "alphv", "label": "ALPHV", "isStack": false, "url": "https://pwn.watch/t/alphv", "feed": "https://pwn.watch/t/alphv/feed.xml" }, "counts": { "incidents": 2, "live": 0, "notFullyPatched": 0, "patched": 2 }, "incidents": [ { "slug": "change-healthcare-ransomware-attack", "title": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack", "json": "https://pwn.watch/i/change-healthcare-ransomware-attack.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "product": "Change Healthcare (UnitedHealth Group / Optum)", "tags": [ "change-healthcare", "unitedhealth", "healthcare", "ransomware", "alphv", "citrix", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-02-21", "closedAt": "2024-10-22", "updatedAt": "2024-10-22", "summary": "The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).", "xPost": null }, { "slug": "mgm-resorts-caesars-scattered-spider-2023", "title": "MGM Resorts and Caesars hit by Scattered Spider", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023", "json": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "MGM Resorts International; Caesars Entertainment", "tags": [ "mgm-resorts", "caesars", "scattered-spider", "alphv", "ransomware", "social-engineering", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-09-07", "closedAt": "2023-10-05", "updatedAt": "2023-10-05", "summary": "Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.", "xPost": null } ], "posts": [], "changes": [ { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-10-22", "title": "Change Healthcare tells HHS OCR it has sent about 100 million individual notices", "body": null, "sourceUrl": "https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-01", "title": "CEO Andrew Witty testifies before the Senate Finance Committee", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-22", "title": "UnitedHealth: stolen files could cover a substantial proportion of people in America", "body": null, "sourceUrl": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-22", "title": "UnitedHealth files an SEC 8-K on the cybersecurity incident", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/731766/000073176624000085/unh-20240221.htm", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-21", "title": "Ransomware deployed; Change Healthcare systems disconnected", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-12", "title": "Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-05", "title": "MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-14", "title": "Caesars 8-K filing; reports say it paid about half of a $30M demand", "body": null, "sourceUrl": "https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-12", "title": "MGM statement on the cybersecurity issue", "body": null, "sourceUrl": "https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-11", "title": "MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-07", "title": "Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" } ] }