Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label UnitedHealth. Show all posts
UnitedHealth
Clorox Cyber Security Data Compromise Prudential Financial cyberattack Risk Management SEC UnitedHealth

SEC Tightens Cybersecurity Regulations for Public Companies

 



In 2023, the Securities and Exchange Commission (SEC) significantly tightened its cybersecurity regulations for publicly traded companies. This move, aimed at enhancing investor protection and ensuring market transparency, responds to the increasing prevalence of cyber threats and their potential to disrupt business operations and financial stability.

New Rules for Incident Disclosure

The SEC's updated regulations require companies to disclose cybersecurity incidents within four days of determining their material impact. Companies must swiftly evaluate the scope and severity of any cyberattack, including the nature and amount of data compromised and the potential business, legal, or regulatory impacts. The goal is to provide timely and accurate information about incidents that could affect a company's financial health or market performance.

Case Studies: Clorox, Prudential Financial, and UnitedHealth

Recent cyber incidents involving Clorox, Prudential Financial, and UnitedHealth offer insights into how companies handle these new requirements.

Clorox: In August 2023, Clorox faced a major cyberattack that disrupted its automated order processing system, leading to significant delays and product shortages. This disruption is expected to cost the company between $57 million and $65 million in fiscal year 2024, largely for IT recovery and professional services. Additionally, Clorox’s Chief Information Security Officer (CISO) left the company following the attack, which revealed long-standing security issues that had previously been flagged in audits.

Prudential Financial: In February 2024, Prudential Financial reported a cyber breach involving unauthorised access to its infrastructure, affecting administrative and user data. The breach, linked to the ALPHV ransomware group, compromised the personal information of 36,545 individuals. Prudential took a proactive approach by disclosing the incident to the SEC before determining its material impact, indicating a possible new trend toward early transparency.

UnitedHealth: UnitedHealth’s subsidiary, Change Healthcare, experienced a significant cyberattack that compromised millions of patient records and disrupted prescription and claims processing. Initially attributing the attack to a nation-state, UnitedHealth focused on restoring operations without immediately assessing its materiality. The incident has led to substantial financial repercussions, including at least 24 lawsuits and potential costs up to $1.6 billion. Following the disclosure, UnitedHealth’s stock price dropped by nearly 15%.

Key Takeaways for Risk Management

These examples highlight several important lessons for companies under the new SEC regulations:

1. Visibility and Accountability: Companies must continuously oversee their digital assets and promptly address security vulnerabilities. Ignorance is no longer a viable defence, and businesses must be able to explain the details of any breaches.

2. Transparency and Proactive Measures: Transparency is crucial. Companies should adopt conservative and proactive cybersecurity policies and be prepared to update disclosures with more detailed information as it becomes available.

3. Information Sharing: Sharing information about cyber breaches and effective security strategies benefits all sectors. This collaborative approach enhances overall security practices and accelerates the adoption of best practices across the industry.

The SEC’s new cybersecurity regulations shift towards more stringent oversight, pushing the growing need for robust cybersecurity measures to protect market stability and investor interests. As companies adjust to these requirements, the experiences of Clorox, Prudential Financial, and UnitedHealth provide valuable lessons in effective risk management and transparency.


Read more »
UnitedHealth
Cyberattacks CyberCrime Cyberhacks Cybersecurity Data Breach Healthcare Personal Data UnitedHealth

Cyberattack Fallout: UnitedHealth Reveals Personal Data Breach Impact

 


As part of its ongoing data breach response, UnitedHealth Group has informed its subsidiaries, Change Healthcare, that they have recently experienced a data breach. Following the February cyberattack on its subsidiary Change Healthcare, UnitedHealth Group revealed on Monday that it had paid ransom to cyber threat actors to protect patient data. 

Additionally, the company confirmed that there was a breach of files with personal information that had been compromised. In the aftermath of the attack, Change Healthcare's payment processing service was affected, and other vital services such as prescription writing, payment processing, and insurance claims were adversely affected, affecting healthcare providers and pharmacies across the United States. 

It was reported that $872 million worth of financial damage had been sustained as a result of the cyberattack. On Monday, UnitedHealth Group announced that it had published an update about the status of its monitoring of the internet and dark web to determine if data had been leaked. The update was published along with leading external industry experts. 

There are many tools provided by Change Healthcare for managing the payment and revenue cycle. This company facilitates more than 15 billion transactions each year, and one in three patient records pass through the company's systems each year. 

UnitedHealth has revealed that 22 screenshots of compromised files, allegedly taken from the compromised files, had been uploaded to the dark web, which means even patients who are not UnitedHealth customers may have been affected by the attack. There has been no publication of any additional data by the company, and they have not seen any evidence that doctor's charts or full medical histories have been accessed in the breach. 

As part of its earlier ransomware attack on its subsidiary, Change Healthcare, UnitedHealth Group has revealed that the company has suffered a significant breach that has exposed private healthcare data from "substantially a quarter" of Americans. The Change Healthcare Group manages the insurance and billing for hospitals, pharmacies, and medical practices in the U.S. healthcare industry, which offers extensive health data on approximately half of all Americans, as well as providing insurance services to numerous hospitals, pharmacies, and medical practices. 

Considering the complexity and ongoing nature of the data review, it is likely to take several months to be able to identify and notify individuals and customers who have been affected by the situation. Rather than waiting until the completion of the data analysis process for the company to provide support and robust protections, the company is immediately providing support and robust protections as part of its ongoing collaboration with leading industry experts to analyze the data involved in this cyberattack. 

In May, The Record reported that UnitedHealth Group's CEO Andrew Witty will be expected to testify before a House panel regarding the ransomware attack. Two representatives of the House Subcommittee on Health testified at the hearing last week about the cyberattack. UnitedHealth Group failed to make anyone available during the hearing. 

UnitedHealth Group reported in March that it had spent $22 million on recovering data and systems encrypted by the Blackcat ransomware gang after paying the ransom. As a result of their attack on UnitedHealth in 2008, BlackCat was accused by a member of the gang known as "Notchy" of cheating them out of their ransom payment because they had UnitedHealth data. After all, they had conducted the attack and BlackCat had fallen into their trap. 

It was confirmed by researchers that the transaction was visible on the Bitcoin blockchain and that it had reached a wallet used by BlackCat hackers at the time the transaction was reported. The U.S. government launched an investigation about a week after the ransomware attack on Optum, investigating whether or not any health data had been stolen. 

On February 21, 2018, a cyberattack hit Change Healthcare, a subsidiary of UnitedHealth Group that is owned by Optum, a company that is a subsidiary of Optum. Due to this downtime, hospitals and physician groups across the country were unable to receive their claims payments from the company. Change has been working to restore connectivity to the provider network; however, delays in the submission and receipt of payments continue to affect provider revenue, despite the improvement in connectivity. 

There was "strong progress" being made by UnitedHealth in the restoration of its Change services during its status update on Monday. After the cyberattack on Change Healthcare, UnitedHealth Group has been vigilantly monitoring the internet and dark web to ensure that any sensitive data has not been exposed further on the internet and dark web. 

There has been an increase in external cybersecurity experts that the company has enlisted to enhance its monitoring capabilities. The company has also developed a group of advanced monitoring tools that search continuously for evidence of data misuse on the Internet and dark web, which allows it to identify and take action quickly when there is any evidence. 

UnitedHealth Group has developed expert cybersecurity partnerships which are intended to mitigate data breaches by collaborating with cybersecurity professionals. Furthermore, UnitedHealth Group's law enforcement and regulatory agencies, as well as other regulatory bodies, are constantly communicating with and cooperating with UnitedHealth Group.
Read more »
UnitedHealth
Change Ransomware Cyber Attacks Data Transparency Healthcare Ransomware UnitedHealth

Change Ransomware Attack: UnitedHealth Profits from a Crisis it Created

Change Ransomware Attack

Change Ransomware Incident: Details so far

The change Ransomware attack

  • Last week, an Oregon medical practice suffered a serious Ransomware attack called Change Ransomware.
  • Due to the attack, the medical practice was left with an empty bank account.
  • The only way out was to sell the practice to United Health. 

Emergency Exemption Request

  • UnitedHealth applied for an emergency exemption to speed up its acquisition of a medical practice in Corvallis, Oregon. 
  • The practice was on the verge of shutting down if the merger wasn't approved immediately.
  • The reason for this immediate merger is unclear, however, inside sources disclosed that it's the same issue affecting other health providers in the U.S.- the intentional weeks-long outage of United Health's Change Healthcare clearing and claims processing systems.
  • The outage compromised the flow of information essential for healthcare providers to get paid.

United Health's Profit Amid Crisis

  • United Health, a health insurer giant, has profited from desperation due to a hack of its Change computer systems. 
  • Roughly half of all healthcare transactions are down through Change.
  • The outage impacted 137 software apps that healthcare providers use. 
  • While healthcare providers try to cope with huge revenue losses, UnitedHealth keeps profiting and avoids disclosing its wealth.
  • UnitedHealth offered an emergency zero-interest lending program, providing small loans to healthcare institutions to "tide them over."

In the complicated healthcare industry, sometimes profit margins are prioritized over patient wellbeing. The recent UnitedHealth incident has raised concerns and left people in wonder. The controversy revolves around a Ransomware attack, a moral dilemma between ethical responsibility and financial interests, and an emergency exemption. UnitedHealth's Cyberattack Should Serve as a 'Wake-up Call' for HealthCare Sector

The Change Ransomware Attack

In Corvallis, Oregon, a medical facility practice faced a difficult situation. The change Ransomware attacks cost them their earnings, leaving the bank accounts empty, and almost pushing them on the verge of shutting down. 

To save themselves, the medical facility practice approached UnitedHealth. 

The Emergency Exemption Request

UnitedHealth immediately demanded an emergency exemption to speed the process of acquiring the struggling practice. The reason for the urgent exemption was unclear, however, inside sources suggested a common link: the weeks-long outage, that would slowly push healthcare providers on the brink of shutting down. The outage would disrupt the flow of information crucial for providing salaries to healthcare providers. 

UnitedHealth's Profits, Others Suffer in Crisis

Here's when the story gets interesting. UnitedHealth has profited from the desperate emergency exemption due to its own system's hacking. Half of the total healthcare transactions depend on Change. 

While healthcare providers were dealing with the losses and on the edge of falling, UnitedHealth declined to share its wealth. However, UnitedHealth is making profits. 

Learnings from the Change Ransomware Attack and UnitedHealth's Approach

The healthcare sector is also evolving quickly. Insurer Giants like UnitedHealth should be made accountable for their actions, and we must scrutinize their actions. 

The crisis amid which UnitedHealth made profits again underlines the dire need for accountability, transparency, and an honest commitment to patient wellbeing.

Ethics must prevail in the delicate balance between profit and well-being. 

Read more »
Subscribe to: Posts (Atom)