Senators Demand Answers from CISA Over Ransomware Attack on US Healthcare Giant Change Healthcare

A group of three US senators, headed by Senator Elizabeth Warren, sent a letter to the US Cybersecurity and Infrastructure Security Agency (CISA) requesting information on its response to a ransomware attack on an insurance company that affected the country’s healthcare system. The attack targeted Change Healthcare, a unit of UnitedHealth Group Inc., leading to significant disruptions in payments and breaches in patient medical data.

The senators wanted to know about CISA’s efforts in addressing the breach, its collaboration with other government agencies, and strategies to combat ransomware threats. They also requested details on how CISA worked with the FBI to provide information about the BlackCat hacker group allegedly responsible for the breach. The senators wanted to know about the frequency and costs of ransomware attacks, efforts to create a warning system, and strategies to prevent the payment of ransoms with cryptocurrencies.

The intrusion at Change demonstrated the vulnerabilities of centralized systems in the healthcare industry, affecting billions of dollars in payments and potentially reducing UnitedHealth’s profits by $1.6 billion. The urgent threat posed by cybersecurity breaches prompted the senators to seek a comprehensive understanding of the cybersecurity landscape, especially surrounding the events related to the Change cyberattack.

UnitedHealth confirmed paying a ransom to protect patient data but did not disclose the amount. A spokesperson for CISA declined to comment on the matter. The senators sent their letter shortly before UnitedHealth’s top executive is set to address the attack in House and Senate hearings.