Omar Marques | Light racket | Getty Images
CEO Andrew Witty told lawmakers Wednesday that the info of about one-third of Americans can have been compromised in a cyberattack on its Change Healthcare subsidiary and that the corporate had paid a $22 million ransom to the hackers.
Witty testified before the Subcommittee on Oversight and Investigations, which reports to the House Energy and Commerce Committee. He said the investigation into the breach remains to be ongoing, so the precise number of people affected by the breach stays unknown. One-third of the figure is a rough estimate.
UnitedHealth previously said the cyberattack would likely affect a “significant portion of people in America.” April issue. The company confirmed that files containing protected health and private information were compromised as a result of the breach.
It will likely be months before UnitedHealth is in a position to notify individuals, given the “complexity of the data review,” the discharge said. The company offers free access to identity theft protection and credit monitoring for people who find themselves concerned about their data.
Witty also testified Wednesday before the U.S. Senate Finance Committee, where he confirmed for the primary time that the corporate had paid a $22 million ransom to hackers who breached Change Healthcare’s security. At a hearing before House lawmakers later that afternoon, Witty said the payment was made in bitcoin.
UnitedHealth disclosed that a cybercrime actor breached part of Change Healthcare’s IT network in late February. After the threat was detected, the corporate disconnected the affected systems, and the disruption caused widespread impacts across the U.S. healthcare sector.
Witty told the subcommittee in his written testimony that on Feb. 12, cybercriminals used “tainted credentials” to infiltrate Change Healthcare’s systems and deployed ransomware that encrypted the network nine days later.
The portal initially accessed by malicious actors was not protected by multi-factor authentication, or MFA, which requires users to confirm their identity in a minimum of two other ways.
On Wednesday, Witty told each committees that UnitedHealth currently has MFA implemented on all external systems.
