6 ms·

Change Healthcare starts sending data breach notifications after cyberattack

30 points by shinryudbz 2y ago

MR4D 2y ago
One thing I’d like to know is who are doing these? - Nation-states? - Criminals? - 3rd party actors on behalf of nation states? It seems like there are different levels of security at play.
- The28thDuck 2y ago
  I wonder if these are novel attacks or if we’re still really bad at getting phished lol. The question I have is what happens when all “private” information is exposed in a society.
  - tyre 2y ago
    CHC was phishing of a customer service rep who had VPN access.
  - SoftTalker 2y ago
    I would guess it's mostly phishing. Even if people are educated about it, it only takes one mistake of opening an attachment or entering a password in a reasonably good fake form.
- xyst 2y ago
  when companies make it very easy to get access to unsecured production assets. You don’t need a “nation state” to infiltrate anymore. Companies do not care about your private data. A data breach is now considered priced in. It’s a footnote in the quarterly reports. Maybe lasts half a news cycle until media brings up presidential candidate age/competence. What we need is a legal framework to decide how much these companies will get fined. We need billions of dollars in fines to bring them to their knees and get their shit in order. We also need execs to get jail time for their negligence.
- tyre 2y ago
  CHC was hacked by a hacker collective called AlphV. United Healthcare (CHC’s parent company) paid a ransom of $28m iirc, which AlphV allegedly rug pulled. So the hackers that did the hack itself didn’t get paid and retained the data. Wild ride. Nation-states would definitely be interested in medical claims data at the scale of CHC. One of the payers is called CHAMPUS, which covers active and retired service members and their families. This is indicated on the claims. So leaking these claims gives access to where service members live and who their family members are. Since military bases in the US tend to have specific units and specialties, you can get a good approximation for how the military is allocating its strength. Plus you know who to blackmail.
  - deleted 2y ago
    [deleted]
- houseplant 2y ago
  the people who recently leaked a bunch of governmental memos about the republican party a day ago were all furries who were dissatisfied with their far-right hatred of trans people. Maybe, some highly educated people are just fed up and calling their senators doesn't seem to get anything done?
The28thDuck 2y ago
4 major organizations breached in the past week? Is this some sort of coordinated attack? It seems everyone and their grandmother has had their information in some way exposed to the internet. The time of pseudo-anonymity is over.
- deleted 2y ago
  [deleted]
- tyre 2y ago
  Change Healthcare was breached in late February. They suddenly pulled themselves offline and we had to migrate to a new clearinghouse over a weekend. The NYT didn’t write about it for two or three weeks, which was crazy because they process medical claims data for over 100m Americans. There’s a lot of information in claims.
- usui 2y ago
  Even assuming that were true, I would disagree with attributing most of a successful breach to a wider attack at large. A successful breach on Change Healthcare occurred because their software development practice is garbage. They have difficulty hiring talent because their talent acquisition process is broken and directed from guys in Nashville who have no clue how to handle developers on the West Coast. Big dependence on manual QA from teams in overseas contractors with no automation, and for developers on that side, there's no transfer of information when the code turns into spaghetti. Code review is weak and mostly for show. Single-account passwords for use in SFTP and outdated protocols. All logic goes into SQL stored procedures when it's completely unnecessary and none of the database developers know how to wrangle it anymore because someone decided all business logic should be in stored procedures (job security?). All software planning and business meetings happen as Waterfall with elaborate Unified Modeling Language but pretends to be Agile so obviously there is ritualistic Scrum, even though it doesn't fit the process that actually happens on a day-to-day basis. When it comes to software, Change Healthcare cares about optics and most processes are for show, not actual effect, and especially when it comes to security. https://news.ycombinator.com/item?id=40132012 https://news.ycombinator.com/item?id=40132012
- ChrisArchitect 2y ago
commercialnix 2y ago
More than adequate modern IT functionality exists that there is no valid excuse for these data leaks to be happening.
- SoftTalker 2y ago
  Yet they keep happening. So is it really adequate? Why is it so hard to get it right?
  - MeImCounting 2y ago
    Because they cost time and money to implement and there is no incentive to avoid data breaches. This should be up to legislation, if we as a society actually care about privacy we need to give data privacy laws some teeth and start really enforcing them.
    - eastbound 2y ago
      I’m sorry but sometimes it’s not money, it’s employees who are malevolently careless. Yes, you can spend huge sums of money locking up their computer so much that it would require 5 or 10 people to do the job of one because they only have a text editor, but we should also get into law that installing a remote desktop incurs liability on the employee side. I won’t say get the company off the hook, but employees are actively malevolent.
      - commercialnix 2y ago
        > it’s not money, it’s employees who are malevolently careless This, 1,000%
  - dtx1 2y ago
    Because of this: https://www.youtube.com/watch?v=SiB8GVMNJkE https://www.youtube.com/watch?v=SiB8GVMNJkE
    - smcin 2y ago
sneak 2y ago
The solution is to stop requiring strong ID for every dumb transaction in the universe. I got carded for a chest x-ray two days ago. There’s no universe in which this makes sense. The nail salon asks for your phone number even if you’re a walk-in. Americans are so used to this that they even have a hand gesture for “papers please”. For centuries we could transact without ID; why now?
- singleshot_ 2y ago
  What is the hand gesture for "papers, please?"
  - MeImCounting 2y ago
    Perhaps they mean the finger thumb box thing bartenders do when asking for your ID?
  - sneak 2y ago
    It’s a C shape with the index finger and thumb, held up around face height.
- bgribble 2y ago
  For medical procedures, I think it makes sense to check ID - just for the potential testimonial "audit trail" in case of actual or purported malpractice. "Are you CERTAIN that the X-ray we are looking it is of the plaintiff? How would you know if someone else showed up and claimed to be them? Is your memory completely infallible?" etc... It might not be of any real significance but poor process can make one side look like they don't have their sh*t together.
  - sneak 2y ago
    Every other industrialized country that I’ve ever been to has taken me at my word when I provided my name for medical procedures. It works fine and always has.
- houseplant 2y ago
ChrisArchitect 2y ago
This is news from June. Related: Change Healthcare hackers used stolen credentials and no MFA, says UHG CEO https://news.ycombinator.com/item?id=40209894 https://news.ycombinator.com/item?id=40209894 Single Citrix Compromised Credential Results in $22M Ransom https://news.ycombinator.com/item?id=40221925 https://news.ycombinator.com/item?id=40221925
- smcin 2y ago
  The new news is that they (finally) started formally notifying end-users i.e. insured patients. Five months after notifying regulators [0]. (Although they would have found out informally if they'd had any claims or interactions with providers). Under the current definition of "notification", the true extent of the harm (to end-user insured/ patients, not to the company or its stock) only becomes apparent when individual patients go check their SSNs, logins, claims, identity theft, credit reports. One of their providers, Option Care Health INC's SEC 8-K from 03/14/2024 merely says this, it doesn't tell patients which of their details or how many million might have been compromised, or when exactly, or how to go find out: > Option Care Health, Inc... was informed that Change Healthcare, a subsidiary of UnitedHealth Group, experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. The Company utilizes several applications provided by Change Healthcare for, among other things, verification of benefits for existing and prospective patients, submission of claims to health plans for processing and payment, and application of cash remittances. At the time of the system disruption on February 21, 2024, Option Care Health disconnected its operations from Change Healthcare applications and has since been working continuously to find alternative processes to help maintain patient care and its overall operations. [0]: US health tech giant Change Healthcare hit by cyberattack - Feb 21, 2024 https://news.ycombinator.com/item?id=39479930 https://news.ycombinator.com/item?id=39479930 [1]: https://investors.optioncarehealth.com/static-files/912a9cbc-d5d8-4362-be90-ec495a68fc76 https://investors.optioncarehealth.com/static-files/912a9cbc...
  - blackeyeblitzar 2y ago
    Change’s HIPAA notice actually says they won’t tell affected patients what exactly of theirs was compromised: > CHC cannot confirm exactly what data has been affected for each impacted individual Why not? Their CEO and partnering insurers’ CEOs need to be jailed.
blackeyeblitzar 2y ago
Here is Change’s HIPAA substitute notice: https://www.changehealthcare.com/hipaa-substitute-notice https://www.changehealthcare.com/hipaa-substitute-notice This is just an insanely vague and worthless notice. And it is infuriating that healthcare customers are made vulnerable by the vendors used by insurers like Cigna or whoever. Change is so disingenuous that they admit the following was stolen: > Health information (such as medical record numbers, providers, diagnoses, medicines, test results, images, care and treatment) But claim with a straight face that no “full medical histories” were compromised. What sort of two faced word game are they playing? Those ARE full medical histories. I also saw recently that Fred Hutch was also compromised: https://www.fredhutch.org/en/about/about-the-hutch/accountability-impact/notice-to-our-patients-of-data-security-incident.html https://www.fredhutch.org/en/about/about-the-hutch/accountab... And of course due to vague partnerships between other hospitals and them, like the University of Washington hospitals, people who were never their customers also were affected. This has to stop and it has to happen through regulation, fines, jail time, all retroactively applied. All these companies underfund security because posting a notice and offering credit monitoring is all it takes to move on.

30 points by shinryudbz 2y ago

MR4D 2y ago

One thing I’d like to know is who are doing these? - Nation-states? - Criminals? - 3rd party actors on behalf of nation states? It seems like there are different levels of security at play.

The28thDuck 2y ago
I wonder if these are novel attacks or if we’re still really bad at getting phished lol. The question I have is what happens when all “private” information is exposed in a society.
- tyre 2y ago
  CHC was phishing of a customer service rep who had VPN access.
- SoftTalker 2y ago
  I would guess it's mostly phishing. Even if people are educated about it, it only takes one mistake of opening an attachment or entering a password in a reasonably good fake form.
xyst 2y ago
when companies make it very easy to get access to unsecured production assets. You don’t need a “nation state” to infiltrate anymore. Companies do not care about your private data. A data breach is now considered priced in. It’s a footnote in the quarterly reports. Maybe lasts half a news cycle until media brings up presidential candidate age/competence. What we need is a legal framework to decide how much these companies will get fined. We need billions of dollars in fines to bring them to their knees and get their shit in order. We also need execs to get jail time for their negligence.
tyre 2y ago
CHC was hacked by a hacker collective called AlphV. United Healthcare (CHC’s parent company) paid a ransom of $28m iirc, which AlphV allegedly rug pulled. So the hackers that did the hack itself didn’t get paid and retained the data. Wild ride. Nation-states would definitely be interested in medical claims data at the scale of CHC. One of the payers is called CHAMPUS, which covers active and retired service members and their families. This is indicated on the claims. So leaking these claims gives access to where service members live and who their family members are. Since military bases in the US tend to have specific units and specialties, you can get a good approximation for how the military is allocating its strength. Plus you know who to blackmail.
- deleted 2y ago
  [deleted]
houseplant 2y ago
the people who recently leaked a bunch of governmental memos about the republican party a day ago were all furries who were dissatisfied with their far-right hatred of trans people. Maybe, some highly educated people are just fed up and calling their senators doesn't seem to get anything done?

The28thDuck 2y ago

4 major organizations breached in the past week? Is this some sort of coordinated attack? It seems everyone and their grandmother has had their information in some way exposed to the internet. The time of pseudo-anonymity is over.

deleted 2y ago
[deleted]
tyre 2y ago
Change Healthcare was breached in late February. They suddenly pulled themselves offline and we had to migrate to a new clearinghouse over a weekend. The NYT didn’t write about it for two or three weeks, which was crazy because they process medical claims data for over 100m Americans. There’s a lot of information in claims.
usui 2y ago
Even assuming that were true, I would disagree with attributing most of a successful breach to a wider attack at large. A successful breach on Change Healthcare occurred because their software development practice is garbage. They have difficulty hiring talent because their talent acquisition process is broken and directed from guys in Nashville who have no clue how to handle developers on the West Coast. Big dependence on manual QA from teams in overseas contractors with no automation, and for developers on that side, there's no transfer of information when the code turns into spaghetti. Code review is weak and mostly for show. Single-account passwords for use in SFTP and outdated protocols. All logic goes into SQL stored procedures when it's completely unnecessary and none of the database developers know how to wrangle it anymore because someone decided all business logic should be in stored procedures (job security?). All software planning and business meetings happen as Waterfall with elaborate Unified Modeling Language but pretends to be Agile so obviously there is ritualistic Scrum, even though it doesn't fit the process that actually happens on a day-to-day basis. When it comes to software, Change Healthcare cares about optics and most processes are for show, not actual effect, and especially when it comes to security. https://news.ycombinator.com/item?id=40132012 https://news.ycombinator.com/item?id=40132012
ChrisArchitect 2y ago

commercialnix 2y ago

More than adequate modern IT functionality exists that there is no valid excuse for these data leaks to be happening.

SoftTalker 2y ago
Yet they keep happening. So is it really adequate? Why is it so hard to get it right?
- MeImCounting 2y ago
  Because they cost time and money to implement and there is no incentive to avoid data breaches. This should be up to legislation, if we as a society actually care about privacy we need to give data privacy laws some teeth and start really enforcing them.
  - eastbound 2y ago
    I’m sorry but sometimes it’s not money, it’s employees who are malevolently careless. Yes, you can spend huge sums of money locking up their computer so much that it would require 5 or 10 people to do the job of one because they only have a text editor, but we should also get into law that installing a remote desktop incurs liability on the employee side. I won’t say get the company off the hook, but employees are actively malevolent.
    - commercialnix 2y ago
      > it’s not money, it’s employees who are malevolently careless This, 1,000%
- dtx1 2y ago
  Because of this: https://www.youtube.com/watch?v=SiB8GVMNJkE https://www.youtube.com/watch?v=SiB8GVMNJkE
  - smcin 2y ago

sneak 2y ago

The solution is to stop requiring strong ID for every dumb transaction in the universe. I got carded for a chest x-ray two days ago. There’s no universe in which this makes sense. The nail salon asks for your phone number even if you’re a walk-in. Americans are so used to this that they even have a hand gesture for “papers please”. For centuries we could transact without ID; why now?

singleshot_ 2y ago
What is the hand gesture for "papers, please?"
- MeImCounting 2y ago
  Perhaps they mean the finger thumb box thing bartenders do when asking for your ID?
- sneak 2y ago
  It’s a C shape with the index finger and thumb, held up around face height.
bgribble 2y ago
For medical procedures, I think it makes sense to check ID - just for the potential testimonial "audit trail" in case of actual or purported malpractice. "Are you CERTAIN that the X-ray we are looking it is of the plaintiff? How would you know if someone else showed up and claimed to be them? Is your memory completely infallible?" etc... It might not be of any real significance but poor process can make one side look like they don't have their sh*t together.
- sneak 2y ago
  Every other industrialized country that I’ve ever been to has taken me at my word when I provided my name for medical procedures. It works fine and always has.
houseplant 2y ago

ChrisArchitect 2y ago

This is news from June. Related: Change Healthcare hackers used stolen credentials and no MFA, says UHG CEO https://news.ycombinator.com/item?id=40209894 https://news.ycombinator.com/item?id=40209894 Single Citrix Compromised Credential Results in $22M Ransom https://news.ycombinator.com/item?id=40221925 https://news.ycombinator.com/item?id=40221925

smcin 2y ago
The new news is that they (finally) started formally notifying end-users i.e. insured patients. Five months after notifying regulators [0]. (Although they would have found out informally if they'd had any claims or interactions with providers). Under the current definition of "notification", the true extent of the harm (to end-user insured/ patients, not to the company or its stock) only becomes apparent when individual patients go check their SSNs, logins, claims, identity theft, credit reports. One of their providers, Option Care Health INC's SEC 8-K from 03/14/2024 merely says this, it doesn't tell patients which of their details or how many million might have been compromised, or when exactly, or how to go find out: > Option Care Health, Inc... was informed that Change Healthcare, a subsidiary of UnitedHealth Group, experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. The Company utilizes several applications provided by Change Healthcare for, among other things, verification of benefits for existing and prospective patients, submission of claims to health plans for processing and payment, and application of cash remittances. At the time of the system disruption on February 21, 2024, Option Care Health disconnected its operations from Change Healthcare applications and has since been working continuously to find alternative processes to help maintain patient care and its overall operations. [0]: US health tech giant Change Healthcare hit by cyberattack - Feb 21, 2024 https://news.ycombinator.com/item?id=39479930 https://news.ycombinator.com/item?id=39479930 [1]: https://investors.optioncarehealth.com/static-files/912a9cbc-d5d8-4362-be90-ec495a68fc76 https://investors.optioncarehealth.com/static-files/912a9cbc...
- blackeyeblitzar 2y ago
  Change’s HIPAA notice actually says they won’t tell affected patients what exactly of theirs was compromised: > CHC cannot confirm exactly what data has been affected for each impacted individual Why not? Their CEO and partnering insurers’ CEOs need to be jailed.

blackeyeblitzar 2y ago

Here is Change’s HIPAA substitute notice: https://www.changehealthcare.com/hipaa-substitute-notice https://www.changehealthcare.com/hipaa-substitute-notice This is just an insanely vague and worthless notice. And it is infuriating that healthcare customers are made vulnerable by the vendors used by insurers like Cigna or whoever. Change is so disingenuous that they admit the following was stolen: > Health information (such as medical record numbers, providers, diagnoses, medicines, test results, images, care and treatment) But claim with a straight face that no “full medical histories” were compromised. What sort of two faced word game are they playing? Those ARE full medical histories. I also saw recently that Fred Hutch was also compromised: https://www.fredhutch.org/en/about/about-the-hutch/accountability-impact/notice-to-our-patients-of-data-security-incident.html https://www.fredhutch.org/en/about/about-the-hutch/accountab... And of course due to vague partnerships between other hospitals and them, like the University of Washington hospitals, people who were never their customers also were affected. This has to stop and it has to happen through regulation, fines, jail time, all retroactively applied. All these companies underfund security because posting a notice and offering credit monitoring is all it takes to move on.