How Did Breach Total Jump to 190 Million?

UnitedHealth Group is undergoing a public relation headache. Last year, a ransomware attack on subsidiary Change Healthcare disrupted thousands of hospitals and practices for months. Congress began asking questions. The insurer eventually announced in October that the breach affected an estimated 100 million people.

See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction

But last week, acknowledging in a statement to Information Security Media Group that the data review process was “complex,” the insurer has revised its breach count to 190 million people – the equivalent of 56% of the U.S. population.

The company said its latest findings are consistent with a statement last April that data compromised in the cyberattack would impact “a substantial proportion of people.”

But experts said a long list of factors likely contributed to Change Healthcare’s daunting and lengthy endeavor to determine who and how many individuals’ information was compromised.

One factor complicating the situation is that Change Healthcare offered to handle breach notification duties for its thousands of customers affected by the incident.

“This was a hub-and-spoke attack,” said regulatory attorney Rachel Rose. In determining an early estimate for how many individuals were affected, the first step would have been for Change Healthcare to count the number of its business associates and covered entities that create, receive, maintain or transmit protected health information, she said.

“From there, each of these entities would have to provide specific information about the total number of persons impacted by the breach,” she said.

Many of those affected organizations also needed to do their own post-event risk assessment – and many would have also involved a forensic third-party evaluation, she said. “In turn, all of the information that was submitted to Change Healthcare for review – not to mention dealing with lawyers and individual insurance companies” were factors contributing to the complex and lengthy breach analysis involved in the incident, she said.

Another aspect likely contributing to the enormous number of people ultimately affected is Change Healthcare’s data retention practices, said regulatory attorney Sara Goldstein of the law firm BakerHostetler.

“It has been said that some of the information involved in the Change Healthcare incident was upwards of 25 years old. It is not clear whether Change Healthcare had a data retention policy or if they followed it,” she said.

Additionally, the massive size of Change Healthcare, its vast number of services it provides, and its large number of customers added to the complexity, she said.

“The size of the data review that Change Healthcare undertook was unprecedented,” Goldstein said. “It has been said that Change Healthcare engaged numerous e-discovery vendors to assist with the data review. The truth is that data reviews take time, even for small incidents, as they often involve unstructured data that takes time to review and assess.”

Indeed, the data review process to determine what information was compromised was undoubtedly overwhelming, other experts said.

“From experience managing incidents like this, I can tell you that you would probably have an army of people helping determine what happened, how they gained access to what systems and resources were touched by the malicious actor,” said Paul Underwood, vice president of security at managed services firm Neovera.

“You need experts in networking, forensics, data analysis and database administrators, as well as experienced incident response managers to build out the timelines and reporting,” he said. “You can expect at least a dozen people or more working on an engagement like this, with supporting personnel in the dozens helping to gather data and information from any systems or networks that were touched or traversed during the attack.”

Jeff Wichman, director of incident response at security firm Semperis, said other issues were also likely at play. “One is data sprawl, where patient data was being kept outside of their normal database/file store. Think when you save a document you’re working on and rather than saving it back to a controlled area, you save it to your local workstation,” he said. “I have seen this on a number of incidents in the past.”

“Another possible reason is simply the amount of data they are dealing with. If attackers were discovered in the environment longer than previously identified, they would have to re-assess the places the attacker was digging,” he said.

Another challenge Change Healthcare faced is that data shared by any organization frequently grows in reach and use through the third party vendors leveraging additional providers – but not clearly notifying the originating site, said Dustin Hutchinson, CISO at security firm Pondurance.

“The spider web of data aggregation in numerous locations continues to grow exponentially even when appropriate data retention policies are followed,” he said. “This incident is a perfect example of unknown or unexpected use of data.”

Organizations should expand their vendor risk management programs to ensure data sharing and retention is closely examined and legal and compliance teams should set clear and strict expectations of use and require communication and approval before additional use of patient data, he suggested.

Updated Statements

Change Healthcare’s ransomware attack on Feb. 17 launched after attackers accessed a Citrix remote access service that the company failed to protect using multifactor authentication (see: Multifactor Authentication Shouldn’t Be Optional).

Parent company UHG admitted paying a $22 million ransom to the Russian-speaking ransomware group Alphv – aka BlackCat – after it claimed to have stolen 6 terabytes of the company’s data (see: UnitedHealth CEO: Paying Ransom Was Hardest Decision Ever).

BlackCat’s operators subsequently shut down their group and kept all of the money, rather than sharing the ransom with the affiliate who hacked Change. In response, the affiliate appears to have taken the data to another ransomware-as-a-service group, RansomHub, and demanded a fresh ransom from Change. Whether UHG also acceded to the second ransom demand isn’t clear.

In July, Change Healthcare provided a placeholder estimate of 500 affected individuals in a breach report to the U.S. Department of Health and Human Services’ Office for Civil Rights.

In October, Change Healthcare updated its breach report to HHS OCR with an estimated 100 million people affected.

On January 14, Change Healthcare again updated a HIPAA substitute breach notice that had been posted on its website for months and had been previously periodically updated.

In that notice, Change said it had been mailing written letters since June “on a rolling basis” to potentially affected individuals for whom the company has a sufficient address, including on behalf of affected Change Healthcare customers who have been notified about the incident and had delegated the notifications process to Change.

Change’s Jan. 14 update to its substitute breach notice indicated that the company’s review of personal information potentially involved in the incident was “substantially complete” and that Change did not anticipate that it will identify any additional customers affected.

On Friday, the company announced its new tally for the breach was 190 million people affected.

“The number we initially provided to HHS OCR was an interim estimate, while our data review was still in progress,” a UnitedHealth Group spokesman told ISMG on Tuesday.

“Now that we have substantially completed the review, we are providing the updated estimate,” the spokesman said (see: Change Healthcare Now Counts 190 Million Data Breach Victims).

Broader Concerns

Some experts said the challenges Change Healthcare faced in its lengthy breach analysis point to an assortment of wider issues in the healthcare sector.

“The time needed to identify individuals affected by the Change Healthcare breach exposes the healthcare industry’s widespread failure to comply with the most basic HIPAA Security Rule standards,” said regulatory attorney Paul Hales of the Hales Law Group.

“HIPAA-regulated entities must know where protected health information is and protect it. Nevertheless, most fail to do regular, effective risk analyses and identify and manage risks, although the Security Rule has required those for over twenty years,” he said.

The enormous size of the Change Healthcare breach emphasizes specific requirements for national health information security, Hales said. “Many are addressed in the HIPAA Security Rule and strengthened by OCR’s proposed Security Rule modifications,” which the Biden administration issued in December (see What’s in HHS’ Proposed HIPAA Security Rule Overhaul?).

How that proposed HIPAA security rule update proceeds will be up to HHS leadership under the Trump administration.

In the meantime, since the February 2024 cyberattack, Change Healthcare’s parent UHG has also been dealing with other significant crises – most notably the December murder in New York City of Brian Thompson, CEO of its United Healthcare health insurance unit – and the subsequent fallout of intense public rage that was unleashed at the company’s claims denial process (see: CEO’s Murder Sparks Outcry Over UHC’s Coverage Denials).