Washington – A cyberattack on health technology provider Change Healthcare is wreaking havoc across the country, leaving some hospitals and pharmacies unable to get paid and many patients unable to get prescriptions.
Change Healthcare is a subsidiary of UnitedHealth Group, one of the largest healthcare companies in the country. In a federal announcement this week, UnitedHealth said Change Healthcare first discovered the hack on Feb. 21 and “immediately” shut down affected systems.
“I mean, we've seen a lot of claims come in as denied claims where the insurer obviously couldn't pay because of this attack,” said Amrish Patel, a pharmacist in Dallas, Texas. “Older patients who are on a fixed income and are trying to get their medication…unfortunately there is no way around that right now.”
Change Healthcare claims to process 15 billion transactions annually, touching one in three patient records in the United States.
Click here to view related media.
Click to expand
“I can tell you that this cyberattack has affected every hospital in the country in one way or another,” said John Riggi, national cybersecurity and risk advisor at the American Hospital Association.
“It’s not a data crime, it’s not an economic crime, these are threats to life,” Riggi added.
In a now-deleted post on the dark web, a Russian-language ransomware group called Blackcat claimed responsibility, claiming it stole more than six terabytes of data, including “sensitive” medical records.
“Change Healthcare can confirm that we are experiencing a cybersecurity issue caused by a cybercrime threat actor who impersonated ALPHV/Blackcat to us,” UnitedHealth told CBS News in a statement responding to Blackcat's claim on Thursday. “Our experts are working to address the matter, and we are working closely with law enforcement and leading third-party advisors Mandiant and Palo Alto Network on this attack on Change Healthcare’s systems.”
UnitedHealth added that its investigation has so far found “no indication” that the systems of its other subsidiaries – Optum, UnitedHealthcare and UnitedHealth Group – “were affected by this issue.”
Change Healthcare says it has payment workarounds in place, but more than a week after the hack was first discovered, its systems are still down, causing billing problems for hospitals and pharmacies. Smaller hospitals are particularly at risk.
“The smaller, less equipped hospitals, our rural hospitals with critical access to the safety net, certainly don't have months of cash reserves,” Riggi said. “Could only be a matter of days or a few weeks.”
In an earlier statement Wednesday, UnitedHealth estimated that more than 90% of the country's pharmacies “have modified electronic claims processing to mitigate the impact of the cyberattack” and “the remainder have workarounds in place for offline processing.”
UnitedHealth has not provided an estimate as to when it expects its systems to return to normal. The FBI is also investigating.
More from CBS News
Nicole Sganga