Cybersecurity is, however, back into focus, and this time because of another medical data breach, irrespective of millions. Imagine waking up one fine day to realize that all the medical information entrusted to your doctor is non-secure. This momentally bound nearly 100 million populations since the onset of a huge and unprecedented cyber breach with many personalities. The larger healthcare breach in one’s hands to date has affected over 100 million people – all the medical, personal details, social security records, diagnoses, test results, and secret data. Earlier this year, a ransomware attack on UnitedHealth, a provider company, caused this breach. Federal lawmakers have confirmed that this breach has revealed personal and medical data on one-third of the U.S. population; it thus poses a very serious risk to the privacy of citizens.
The cyberattack and ransom payment
The ALPHH hacker group (also known as “BlackCat”) They broke cybersecurity with a cyberattack launching a cyberattack on Change Healthcare, one of UnitedHealth’s largest subsidiaries responsible for processing healthcare payments and claims. The breach caused unprecedented operational disruptions in claims processing across the U.S. healthcare system for months. Control of Change Healthcare’s claims functions for numerous major insurers, including Aetna, Anthem, Blue Cross Blue Shield, and Cigna, offered an early warning about the breach, issuing over 100 million notifications to individuals affected by the launch, which included very sensitive data: billing information, some claims and payments, medical records (diagnoses, medical record numbers), member or group identification numbers, social security numbers, and even driver’s license numbers. The notice to the clients was provided toward the end of that month, but the formal public notice was not released until June, by which time it had become legally mandated.
While the federal investigation is still ongoing, the initial details confirm the extent of the breach. UnitedHealth CEO Andrew Witty testified in May that the attackers accessed company systems through the stolen login credentials of employees. He confirmed that payments were made to the hackers— a ransom of 22 million dollars in exchange for a decryption tool—but they did not honor their commitment. After receiving the ransom, BlackCat conducted what was called an “exit scam” and shut down their servers.
Consequences and recommendations for the future
One of the main reasons for the ease of access determined by the hackers to the data was because of a lack of multi-factor authentication (MFA) on the Citrix profile used by UnitedHealth, which created easy access for the criminals into the network. UnitedHealth was forced to revise its internal policy post-attack to make MFA mandatory for all systems—a measure aimed at enhancing security against future breaches.
This cyberattack did not only affect millions of patients but also highlighted how exposed the healthcare sector has been in terms of cybersecurity. With more hospitals and clinics now transitioning to digital medical records, the transition comes with numerous merits but has opened windows through which attackers can exploit, especially if adequate security measures are not instituted.
Cybersecurity experts indicate that data encryption (which transforms information into non-readable code) and implementation of more advanced protocols can save the facility from such attacks by minimizing damages. Besides, educating personnel on digital security in the health sector is vital since attackers mainly use human error to gain access.
It will not be surprising then if victims come together in one class-action lawsuit to seek compensation for the breach of their privacy and the newfound risk they are undergoing. A number of laws, such as HIPAA in the US, seek to protect medical data. They require healthcare entities to provide protections for patients’ information, imposing severe penalties on institutions that fail to comply with such standards.
This cyber-attack is yet another wake-up call that technology may improve the flow of services in medical practice; however, it also has serious privacy considerations. Sensitive patient data shouldn’t be accessible by just anybody, and this incident only isn’t a reminder for the need for stronger protections in the healthcare sector.
