by Kristin Rowan, Editor
For a few weeks now, we have been covering the Change Healthcare cyberattack by ALPHV/BlackCat and the subsequent updates from CMS. Pharmacy and medical orders have been delayed, providers and patients are suffering, and CMS has issued “guidance” with no real solution. Underground reports indicate that Change Healthcare paid $22 million to BlackCat following the first cyberattack and that BlackCat stole 6TB of data from the system. Change Healthcare has refused to respond to questions about the alleged payment. Three weeks after the attack, Change Healthcare started to come back online, starting with the pharmacy services, which returned on March 7th. Parent company UnitedHealth Group indicated that other services would return in the coming weeks.
Legal Action
More than 87% of physicians are see more than a 20% drop in daily claim submissions. As of April 9th, physicians are still reporting issues with cash flow and anticipate higher than expected losses due to financing and loans that may be needed to cover them as the effects of the attack continue. Rivals of Change Healthcare are reportedly onboarding hundreds of customers who have left the organization. One of these, Availity, has processed more than $5 billion in claims that were left unprocessed by Change Healthcare’s system and has onboarded 300,000 providers with a backlog of more than 50 health systems waiting to start using the platform.
The attack has caused long-term disruptions, delays, cash flow problems, patient care disruptions, prescription delays, and billing issues. Some physician practices have started using personal money to cover payroll and other expenses. The US Department of Health and Human Services (HHS) has launched a formal inquiry into Change Healthcare’s data protection standards. This inquiry follows six class action lawsuits filed against the organizations. Physicians were still reporting significant impacts on their claims.
Adding Insult to Injury
Change Healthcare has barely gotten their systems up and running were still putting out fires when they were hit again. 
On April 8, RansomHub contacted Change Healthcare and alleged to have 4TB of data stolen from the system and are demanding an extortion payment to keep the data private . RansomHub has threatened to sell the data, which includes US military personnel and patient data, medical records, and financial data, to the highest bidder in 12 days if the ransom isn’t paid.
Among the prevailing theories as to why Change Healthcare has been hit again is that the first ransom was supposed to have been split between ALPHV/BlackCat and an associate known as “notchy”, but ALPHV absconded with the ransom, leaving the other with nothing. Looking for a payout equal to what they lost, notchy partnered with RansomHub to try to recoup their losses. A second theory is that ALPHV and RansomHub are one in the same and that ALPHV went to ground after the ransom payout and have resurfaced as RansomHub. RansomHub, however, claims that after ALPHV went to ground, some of their affiliates joined the RansomHub operation and this is how they came by the data. Either way, it seems that the data stolen in the first attack was not returned after the ransom was paid and Change Healthcare is still susceptible to further extortion. This also means that the Change Healthcare system was not hacked a second time, but rather this is just an extension of the first data breach.
No word yet on whether Change Healthcare and UnitedHealth Group will pay the second ransom demand.
We will continue to follow this story and provide updates as it impacts payment and claims processing.
# # #
Kristin Rowan has been working at Healthcare at Home: The Rowan Report since 2008. She has a master’s degree in business administration and marketing and runs Girard Marketing Group, a multi-faceted boutique marketing firm specializing in event planning, sales, and marketing strategy. She has recently taken on the role of Editor of The Rowan Report and will add her voice to current Home Care topics as well as marketing tips for home care agencies. Connect with Kristin directly kristin@girardmarketinggroup.com or www.girardmarketinggroup.com©2024 by The Rowan Report, Peoria, AZ. All rights reserved. This article originally appeared in Healthcare at Home: The Rowan Report. www.therowanreport.com One copy may be printed for personal use: further reproduction by permission only. editor@therowanreport.com
