UnitedHealth’s subsidiary, Change Healthcare, a leading healthtech company experienced an alarming ransomware attack in February 2024 leading to a loss of sensitive patient data. The announcement of this attack, the largest theft of medical data in US history, was delayed as the company silently struggled to manage and inform affected parties.
The medical behemoth recorded long-term disruptions, leading to challenges within the US healthcare system. The company hoped to contain the catastrophic breach by cooperating with the hackers’ demands, in an attempt to safeguard further private information from being revealed.
Whilst claiming to have executed their obligations to those affected, significant gaps remain. The monumental task was hampered by critical shortcomings such as insufficient address details for millions of impacted patients. The update was posted on the company’s website, causing confusion as to its discoverability.
A hidden “noindex” code was found embedded by TechCrunch within the breach notice, intentionally making it unsearchable via standard search engines. This secretive hiding technique has been active on the website since late 2024 with no provided explanation by UnitedHealth representatives or Change Healthcare.
The company’s transparency and notification strategies have been under fire, with individual state governments taking matters into their own hands. States such as California, Massachusetts, Nebraska, and New Hampshire initiated their own intervention protocols to educate residents about identity theft and fraud protection.
Nebraska’s legal charges against Change Healthcare in December 2024 marked a significant turning point. Their Attorney General, Mike Hilgers, commented on the serious security inadequacies that led to this catastrophic data breach, leaving the state’s citizens severely unprotected and susceptible to personal exploitation.
Original source: Read the full article on TechCrunch
