The notorious BlackCat ransomware group has officially taken responsibility for the recent devastating cyberattack on Optum’s Change Healthcare, the nation’s largest healthcare payments platform serving over 70,000 pharmacies and touching medical data on millions of Americans. In a statement published today on their dark web site, BlackCat claims to have stolen an astonishing 6 terabytes worth of highly sensitive data including full medical records, insurance information, dental records, payment details, claim data and personally identifiable information like social security numbers, from Change Healthcare’s systems.
BlackCat asserts that the hacked data spans thousands of healthcare providers, insurance companies, pharmacies and other partners. Among the victims are major players like the military’s Tricare health program for armed service members and their families, the federal Medicare insurance scheme for seniors, CVS Caremark, MetLife and dozens of other healthcare payers and insurers, ultimately exposing the medical information of potentially tens of millions of people.
While Optum continues working to restore impacted systems and bring them back online, BlackCat has categorically denied that the cybercriminals behind this breach exploited a recently disclosed critical vulnerability in ScreenConnect software to gain access, as previously speculated. Separately, federal law enforcement, including the FBI, CISA and HHS, issued an alert earlier this week warning that BlackCat ransomware groups routinely single out and compromise healthcare organizations within the United States.
With the number of victims and sensitive medical records impacted by this incident potentially unprecedented in scale, the BlackCat breach of Change Healthcare demonstrates the weakness of legacy healthcare IT systems as well as the evolving sophistication and unrelenting persistence of major ransomware cartels in extracting payouts. This crisis highlights the paramount importance of offline backups, cyber insurance and proactive security postures for healthcare entities entrusted with some of society’s most sensitive data.
