UnitedHealth Group (UHG) is a multinational health insurance and services company based in Minnetonka, Minnesota. They are the largest health care company in the world by revenue and hold the 11th position globally in terms of total revenue.

Change Healthcare is a healthcare technology and business solutions company based in Nashville, Tennessee. They operate the largest financial and administrative information exchange in the United States, connecting payers, providers, and patients within the healthcare system.

Change Healthcare in 2022 merged with Optum, which is a major provider of services in technology, data, pharmacy care and direct health care. UnitedHealth Group acquired Change Healthcare in 2022 in a $13B transaction and is now its parent company.

A cyberattack which began on February 21st, disrupted several Change Healthcare systems and services, leading to a nationwide prescription processing outage and impacting healthcare providers across the country. UHG believes a state-sponsored threat actor is responsible for the attack.

As of today, Change Healthcare is still working to recover impacted applications, and no specific timeframe has been provided for full restoration.

The American Hospital Association (AHA) recommends that healthcare organizations using Change Healthcare services prepare for continued disruption and consider disconnecting from unavailable applications.

A report by SC Media says that security experts have warned for the past couple of days that the two flaws recently uncovered in ConnectWise’s ScreenConnect app could become the major cybersecurity story of 2024 – and that the healthcare and critical infrastructure sectors were especially vulnerable. They believe that the slowdowns at pharmacies was caused by a strain of LockBit malware that was used to exploit the vulnerabilities in ConnectWise ScreenConnect.

News of a cyberattack on the healthcare company broke on Feb. 21 when United Healthcare reported the incident in an 8-K filing with the Security Exchange Commission. In the filing, United Healthcare said they “identified a suspected nation-state associated cyber threat actor” had gained access to some of Change Healthcare’s IT systems.

Pharmacies across the country posted on Facebook last week that they’re still unable to process prescriptions due to the Change Healthcare outages. As of Monday, February 26 FastCompany reports that more than 100 health-related services were impacted by the attack, and there’s still no word on when things will be back to normal.

The Department of Health and Human Services said Wednesday ransomware and hacking are “the primary cyber-threats in health care.” In 2023, large healthcare breaches impacted more than 134 million people – up 141% from the year before – and hacking was the cause of 79% of breaches reported to the HHS Office of Civil Rights.

Healthcare breaches have become more common in the last five years, with breaches involving hacking and ransomware increasing more than 250% each, according to HHS. Last July, America’s largest healthcare system announced a security breach in which personal information like names and contact information were posted online and the breach impacted 11 million people across 20 states, according to HealthcareDive.

Despite the widespread disruption, including prescription delays and frozen services at numerous pharmacies across the United States, the media response to the news has been noticeably low-key.