Change Healthcare’s Ransomware Attack

Let's repeat the painful truth once more: Lack of cybersecurity countermeasures can cost you much more than you expected.

The cyber attacks (especially ransomware attacks) on the health sector have been increasing in recent years. Health sector players have to take this fact into consideration in order to avoid being the next cyber victim of the cyber crime market.

UnitedHealth states that the total costs of the February cyber attack for the first quarter of 2024 stands at $872 million. The total cost reached "$1 billion" with the remediation costs, including a $22 million payment to the ALPHV/BlackCat-affiliated ransomware group. (If you hire 20 cyber security experts each for $250,000, it will cost you $5 million per year.)

This attack also had effects on their shares. ($0.74 per share.)

https://bit.ly/3wcOdHF

"It's a charge that eclipsed that of casino group MGM, which didn't pay a ransom following an attack on its systems last year, and which faces recovery costs of $100 million to rebuild its systems and paying for the fallout from outages, operational disruptions, allegedly leaked data and more."

"The company warned that, financially, the total cost of the cyberattack is estimated to be between $1.35 billion and $1.6 billion for calendar year 2024."

FBI vs. BlackCat

Ransomware attacks keep increasing. It is quite limited what local or international authorities can do against these attacks. The authorities intervene mostly after the ransomware attacks occurred and most of the time it is too late for after you got hit by a ransomware gang.

So be aware that it is YOU who can prevent ransomware attacks and it must be YOU who take actions against the ransomware gangs. DO take actions before you got hit. Allocate enough budget for cyber security before it's too late.

Well, it seems that cat-and-mouse-game between local or international authorities and ransomware gangs won't come to an end in the near future. (You guess who is the cat and who is the mouse in this game.)

Close to the end of the last year (2023), FBI seized the website of a ransomware gang, who are known as BlackCat or AlphV, and obtained some decryptor keys. The cat seems to have nine lives and the gang denied this partly and claimed that they are still -almost- fully operational though.

https://bit.ly/48Fq0av

"The FBI created a decryption tool for the ransomware used by the gang known as BlackCat and/or AlphV, as part of a wider disruption campaign against the extortionists.

The existence of the decryptor was revealed in a Tuesday announcement by the United States Department of Justice that reports the FBI has offered the tool to over 500 orgs and believes $68 million of ransom payments were avoided as a result."

"...The Feds said they were able to access 946 public-private key pairs for Tor-hidden sites the BlackCat gang used to communicate with victims and host its blog,..."

"In other words, it sounds as though the Feds were not only able to seize and shut down the ransomware-as-a-service crew's dark-web presence, agents also obtained enough internal info to provide decryption assistance to victims..."

"The FBI operation was carried out in partnership with the plod in the UK and Australia, and Europol. Their probe into AlphV is ongoing and authorities have advised a reward may be offered to those who offer further information about the crew."

"The gang, believed to be Russian, today boasted it had "unseized" its main dark-web site by pointing it at a web server the miscreants control, rather than an FBI one. The crew used its restored blog to name new alleged victims of its ransomware."

"The FBI's claim of offering a decryptor to more than 500 victims has also been watered down by the group. According to the criminals, the number sits more at the 400 mark while still leaving 3,000 without a decryptor key."