https://pwn.watch/t/unitedhealth Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 22 Oct 2024 00:00:00 GMT https://pwn.watch/i/change-healthcare-ransomware-attack https://pwn.watch/i/change-healthcare-ransomware-attack Tue, 22 Oct 2024 00:00:00 GMT critical <p>The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-22: Change Healthcare tells HHS OCR it has sent about 100 million individual notices (<a href="https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html">source</a>)</li><li>2024-05-01: CEO Andrew Witty testifies before the Senate Finance Committee (<a href="https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf">source</a>)</li><li>2024-04-22: UnitedHealth: stolen files could cover a substantial proportion of people in America (<a href="https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html">source</a>)</li></ul>