Security researchers recently found a new twist in the ongoing saga of the Change HealthCare data breach. The RansomHub ransomware group has allegedly made claims regarding data from the United Health cybersecurity incident. This incident was purportedly part of the ALPHV ransomware group’s final breach and subsequent exit scam, involving a staggering payment of $22 million.
According to security researcher Dominic Alvieri, the RansomHub ransomware group asserts ownership of data, raising suspicions of either an entry scam or potential acquisition of a BlackCat affiliate to obtain the data in question. RansomHub has claimed access to 4TB of data, however, the data is yet to be verified.
RansomHub Claims Access to Change HealthCare Data Breach
The message from the threat actor is clear: they possess sensitive data previously held by ALPHV, raising concerns about the security of highly selective information belonging to Change Health clients. The list of affected partners is extensive, amplifying the gravity of the Change HealthCare data breach.
Talking about what unfolded in the United Health data breach story, the threat actor said, “ALPHV stole the ransom payment (22 Million USD) that Change Healthcare and United Health paid to restore their systems and prevent the data leak. HOWEVER, we have the data and not ALPHV.”
The threat actor further stated that they have access to “4 TB of highly selective data”, which consists of confidential information about the healthcare facility. The data consists of over 4 TB of highly selective data. The data relates to all Change Health clients that have sensitive data being processed by the company”, denoted the threat actor.
This development follows a series of cyberattacks targeting the U.S. healthcare system, with the notorious ALPHV/BlackCat group at the center of attention. The U.S. government has escalated its response, offering a $10 million reward to unmask the individuals behind cyberattacks on US healthcare systems.
The ALPHV/BlackCat Ransomware Attack
ALPHV/BlackCat’s ransomware-as-a-service model wrought havoc on critical infrastructure sectors, including the compromised networks of UnitedHealth Group’s Change Healthcare. The breach, which occurred on February 21, triggered widespread disruptions, necessitating a federal investigation into the matter.
Although Change Healthcare managed to restore services, the fallout from the breach reverberated across healthcare providers and pharmacies nationwide. Vx-underground, hinted at a possible transition of affiliates from ALPHV to RansomHub, raising speculation about the continuity of extortion tactics.
The aftermath of the ALPHV exit scam left many unanswered questions, particularly concerning the fate of the exfiltrated data and the looming threat of further extortion attempts. Now, with RansomHub’s emergence, these questions seem to find unsettling answers as Change Healthcare faces renewed pressure.
However, uncertainties persist regarding RansomHub’s identity and motives. Is it a reincarnation of ALPHV, a migration of affiliates, or a cunning ploy to coerce Change Healthcare into another payout? The ambiguity highlights the complex and evolving nature of cybersecurity threats in the healthcare sector.
This is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the claims made by RansomHub ransomware or any official confirmation from United Health regarding the authenticity of these claims.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
