In a letter to the federal government’s lead cybersecurity agency, a group of three US senators led by Elizabeth Warren of Massachusetts asked for details on CISA’s response to a ransomware attack on an insurance company in February that affected much of the country’s health-care system. The attack targeted Change Healthcare, a unit of UnitedHealth Group Inc., resulting in billions of dollars of payments being disrupted and patient medical data being stolen.
The senators inquired about how CISA collaborated with the FBI and other US government entities to address the hack, what information was provided to UnitedHealth regarding the BlackCat hacker group responsible for the breach, the frequency and cost of such attacks, efforts to establish a warning system, and how the payment of ransoms with cryptocurrencies can be addressed. The attack on Change Healthcare exposed vulnerabilities that can compromise an entire industry, disrupting payments, jeopardizing the financial stability of some clinics and potentially impacting UnitedHealth’s profits by up to $1.6 billion.
The senators emphasized the importance of understanding the cybersecurity landscape in light of this breach. They were joined by Senator Bill Cassidy from Louisiana and Senator Richard Blumenthal from Connecticut. A spokesperson for CISA declined to comment on the matter. The senators sent their letter just before top executives from UnitedHealth were scheduled to address the attack in hearings before Congress. UnitedHealth disclosed that it paid a ransom to protect patient data but did not reveal the amount.