In testimony before the House Committee of Energy and Commerce the UnitedHealth Group’s CEO Andrew Witty shared details of the February 12 ransomware cyberattack on the company by Alphv/BlackCat hackers.

His testimony before the oversight committee took place on May 1.

Bogus Biden Stories: Did a Cannibal Eat his Uncle Bosie? - USA Herald

From Power Player to Pariah: The Downfall of Diddy Documentary - USA Herald

AI Breakthrough: Advancements in Human-Level Reasoning Revolutionize Technology - USA Herald

Boeing/Spirit Safety Scandals: 2nd Whistleblower Died Within 2 Months - USA Herald

Alphv/BlackCat Hackers 

BlackCat, also known as ALPHV and Noberus is a malicious ransomware. In November 2021 it made its first appearance. It is also the name of threat actors and hacker gang who exploit it.

In 2022 the FBI released an advisory that several developers and money launderers for BlackCat had links to two defunct ransomware-as-a-service (RaaS) groups. They were the DarkSide and BlackMatter hacker gangs.

According to experts, the ransomware is a rebranding DarkSide hackers used in the May 2021 attack on the Colonial Pipeline.

Throughout 2022, BlackCat hit numerous high-profile organizations globally. This includes universities, government agencies and companies in the energy, technology, manufacturing, and transportation sectors. 

Some of the reported victims include Moncler, Swissport, North Carolina A&T, Florida International University, the Austrian state of Carinthia, Regina Public Schools, the city of Alexandria, the University of Pisa, and JAKKS Pacific.

Cyberattack Details

The cyberattack on Change Healthcare significantly disrupted the US healthcare system. It involved a nine-day period of infiltration by the Alphv/BlackCat hackers before the ransomware was deployed. 

The CEO disclosed that compromised credentials for a Citrix portal lacking multi-factor authentication allowed the attacker remote access. They moved laterally within the system to steal, and eventually deploy ransomware.

Witty also confirmed that a ransom was paid in an attempt to safeguard personal health information. But hackers engaged in an exit scam in order to extort UnitedHealth Group a second time. 

The group behind BlackCat often uses double extortion tactics. And sometimes utilizes triple extortion exposing exfiltrated data and threatening to launch distributed denial-of-service (DDoS) attacks on victims’ infrastructure.

The full extent of the data breach, which compromised both personally identifiable information (PII) and protected health information (PHI), is still being assessed. It's estimated that a significant portion of the American population may be affected.

UnitedHealth Group Response

Upon discovering the attack, UnitedHealth Group disconnected Change Healthcare's systems from the internet. Then a comprehensive restoration effort was made to  rebuild the infrastructure from scratch. They replaced equipment, rotated credentials, and expanded server capacity. 

Despite substantial progress, services to pharmacies and hospitals were severely impacted.

UnitedHealth Group has allocated over $6.5 billion in advanced funding to affected providers and disclosed costs of $872 million related to the ransomware attack. Potential expenses are projected to reach $1.6 billion by the end of the year.

After the February attack the U.S. Department of State is offered a reward of up to $10 million for leads to identify or locate ALPHV/Blackcat ransomware gang leaders.