The RansomHub extortion gang has begun leaking what they claim is corporate and patient data stolen from United Health subsidiary Change Healthcare in what has been a long and convoluted extortion process for the company.
In February, Change Healthcare suffered a cyberattack that caused massive disruption to the US healthcare system, preventing pharmacies and doctors from billing or sending claims to insurance companies.
The attack was ultimately linked to the BlackCat/ALPHV ransomware operation, who later said they stole 6 TB of data during the attack.
After facing increased pressure from law enforcement, the BlackCat gang shut down their operation.
This occurred amid claims they were pulling an exit scam by stealing a $22 million Change Healthcare ransom payment from the affiliate who conducted the attack.
After BlackCat shut down, the affiliate, Notchy, partnered with the RansomHub ransomware gang to extort Change Healthcare once again, even though the company allegedly already paid a ransom.
Today, a week later, the threat actors have begun to leak screenshots of files they claim were stolen from Change Healthcare during the February ransomware attack.
The screenshots include data-sharing agreements between Change Healthcare and insurance providers, including CVS Caremark, Health Net, and Loomis.
Other documents contain accounting data, including aging reports, insurance payment reports, and other financial information.
What is most concerning is that the leaked data also contains patient information, including amounts owed and bills for patient care services rendered.
The threat actors now say that Change Healthcare has five days to pay an extortion demand, or the threat actors will sell the data to the highest bidder.
While BleepingComputer cannot verify whether the leaked data was stolen from Change Healthcare, it does appear to belong to the company.
BleepingComputer contacted the company with questions about the leak but a reply was not immediately available.
US govt probes if ransomware gang stole Change Healthcare data.
BlackCat ransomware turns off servers amid claim they stole $22 million ransom.
Ransomware gang claims they stole 6TB of Change Healthcare data.
UnitedHealth subsidiary Optum hack linked to BlackCat ransomware.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 15 Apr 2024 21:55:09 +0000