5 ms·

UnitedHealth says data of 100M stolen in Change Healthcare hack

kevinmershon 2y ago
So would this count as 1 instance or 100M instances of HIPAA violations? Last I checked the penalty is $50k per violation...
- whoitwas 2y ago
  Seriously. From what I've learned United needs the axe more than many corporations. Somewhere below Nestle, but above BP maybe?
- nashashmi 2y ago
  First it would have to be proven that data is leaked. Each proven leak is worth $50k. Mass leak is a compromise of data security. And that comes under a different classification.
- oefrha 2y ago
  It’s *up to* 50k per violation. Like most large scale violations of anything, it’s effectively “we’ll fine whatever we want”.
- gruez 2y ago
  Does getting data stolen through no fault of your own count as a HIPPA violation? If negligent security counts, what's the bar?
  - sgarland 2y ago
    It does, actually. There are four tiers [0], with unknowing violation at the bottom, followed by reasonable cause. Personally I’d place this at least at the reasonable cause tier. [0]: https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement https://www.ama-assn.org/practice-management/hipaa/hipaa-vio...
mrbluecoat 2y ago
> an expected $2.45 billion Am I reading that ransom payout correctly? Or are "losses" divided among other things?
azinman2 2y ago
At what point can we sue, especially if basic security practices like 2FA are not enabled?
- hulitu 2y ago
  > At what point can we sue, especially if basic security practices like 2FA are not enabled? And if they are enabled ? Do you think this will make any difference ? We have, at work (Microsoft) 2FA enabled with Windows Hello. At setup it wanted to set a numeric pin. That's all. It asks from time to time about the second factor (Microsoft Authenticator) and that's all.
Evidlo 2y ago
Are they obligated to notify specific customers? How can I know if my data was in the hack?
- prasadjoglekar 2y ago
  I got a mailer that states this. At first, I didn't even know who Change was - they're well in the bowels of the stack. Usual free credit monitoring etc.
mlsu 2y ago
I really don't understand how this level of consolidation has been allowed in the healthcare market. I was affected by this, couldn't get prescriptions filled for 4 days. Turns out I'm not alone -- 100m people? That's 1/3rd of America's population! There is no competition in the marketplace. We need to either nationalize them or break them up. These ransomware groups are small-time compared to a nation-state adversary in wartime. At this point it's a national security issue.
- kmeisthax 2y ago
  Part of the neoliberal consensus that replaced progressive liberalism in the 1970s and 80s is a revisionist reframing of antitrust law in which all monopolies are judged solely by the yardstick of consumer welfare. Problem is, very few monopolies actually harm consumer welfare. Bigger businesses are able to deliver lower prices - at least initially - because they suck the redundancy out of the market. Ergo, consolidation is good actually and antitrust is self-defeating. Of course, those prices will creep up eventually, once the causal link between the consolidation and the market power has been sufficiently obscured. Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public. Because every business has only two or three real competitors, all of whom have extreme levels of class discipline and will agree to lie their asses off to the public. This level of consolidation was allowed because your politicians stabbed you in the back in the name of the """free""" market.
  - sofixa 2y ago
    > Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public. Are you implying there were no supply chain difficulties? China wasn't under heavy lockdown for months on end? There weren't ports with months of backlog? Factories weren't closed due to lockdowns or outbreaks all around the world? That civilian aviation ground to almost a complete halt for a few months, and the cargo it used to carry now didn't need to find an alternative route? Anyone trying to pin a singular reason for the inflation spikes after Covid is at best misinformed and arguing in bad faith. Covid wrecked supply chains, Russia's invasion of Ukraine wrecked a number of important raw materials' markets (oil, gas, nickel, grain, etc), the Houthis' shenanigans impacted the Suez Canal, droughts impacted the Panama canal. Sprinkle a heavy dose corporate greed and voilà, inflation.
albert_e 2y ago
[flagged]
- AStonesThrow 2y ago
  Definitely: all the other text in that image is AI-garbled. You can also tell, because the company name is not correctly stylized, nor is the correct font used, nor is their logo visible here. This is just a 100% fake AI building with some low-effort text slapped on afterwards. Why did they not actually bother to use a photograph of UHC's building? What did you expect from a site called "bleepingcomputer dot com"?
spoonfeeder006 2y ago
I always wonder that maybe someone can convince these health companies, clinics, etc... to start using Qubes OS for their network connected office computers. Maybe that could prevent a sizeable number of these ransomware attacks? TLDR Qubes OS is a security focused operating system that is geared towards end users. It relies on isolation via the Xen hypervisor (has much less privileged code than Linux, Windows, or Mac kernels), and uses hardware based virtualization features of the CPU as well. E.g. it prevents a compromised network card from accessing the memory of a trusted virtual machine through DMA attacks as an example And ultimately it incorporates this isolation into a seamless user interface as well I'm guessing the primary feature that would protect against ransomware is that it allows on to open suspicious links in disposable VMs
- sofixa 2y ago
  With the move of most enterprise software to web interfaces, this could be realistic for some organisation. Others, especially in healthcare, will have odd legacy thick clients developed in obscure languages decades ago that nobody wants to port.
- hsbauauvhabzb 2y ago
  Has there been any organisation to successfully roll this out, ever? It’s great for security, but useless from a productivity standpoint.
- rty32 2y ago
  Not sure using a different OS helps the issue, if not making it worse -- * These days hackers have a lot of resources and are often nation state actors. They utilize 0 day vulnerabilities. I don't see how an obscure OS will do any better than mainstream OS in terms of detecting and responding to exploits * Many hacks actually start with social engineering, and human becomes the weakest point (well, in some sense, it always has been) * Users, most of which are not computer experts, could make more mistakes when they are faced with software/interfaces they are not familiar with. (I'm just making this up, happy to see data that says otherwise.) "Open suspicious links in disposable VMs"? Sure, if they have received enough training and can do it perfectly, every single time, and never confuse the VM and the host environment. I'd say "never open suspicious links, forward the email to IT to help with you if needed", or even, just filtering untrusted domains in the email, is a much simpler and effective approach.
hulitu 2y ago
> UnitedHealth says data of 100M stolen in Change Healthcare hack "Privacy matters to Change Healthcare, so we follow a privacy framework that helps us to manage and protect your personal information in the products and services we provide." I guess this speaks for itself. /s
Rafuino 2y ago
My kid had their first data breach at 2 months old due to a healthcare company we've never heard of having their data and losing it to hackers. This whole industry needs to be burned to the ground.
deleted 2y ago
[deleted]
AIFounder 2y ago
[dead]

So would this count as 1 instance or 100M instances of HIPAA violations? Last I checked the penalty is $50k per violation...

whoitwas 2y ago
Seriously. From what I've learned United needs the axe more than many corporations. Somewhere below Nestle, but above BP maybe?
nashashmi 2y ago
First it would have to be proven that data is leaked. Each proven leak is worth $50k. Mass leak is a compromise of data security. And that comes under a different classification.
oefrha 2y ago
It’s *up to* 50k per violation. Like most large scale violations of anything, it’s effectively “we’ll fine whatever we want”.
gruez 2y ago
Does getting data stolen through no fault of your own count as a HIPPA violation? If negligent security counts, what's the bar?
- sgarland 2y ago
  It does, actually. There are four tiers [0], with unknowing violation at the bottom, followed by reasonable cause. Personally I’d place this at least at the reasonable cause tier. [0]: https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement https://www.ama-assn.org/practice-management/hipaa/hipaa-vio...

mrbluecoat 2y ago

> an expected $2.45 billion Am I reading that ransom payout correctly? Or are "losses" divided among other things?

azinman2 2y ago

At what point can we sue, especially if basic security practices like 2FA are not enabled?

hulitu 2y ago
> At what point can we sue, especially if basic security practices like 2FA are not enabled? And if they are enabled ? Do you think this will make any difference ? We have, at work (Microsoft) 2FA enabled with Windows Hello. At setup it wanted to set a numeric pin. That's all. It asks from time to time about the second factor (Microsoft Authenticator) and that's all.

Evidlo 2y ago

Are they obligated to notify specific customers? How can I know if my data was in the hack?

prasadjoglekar 2y ago
I got a mailer that states this. At first, I didn't even know who Change was - they're well in the bowels of the stack. Usual free credit monitoring etc.

mlsu 2y ago

I really don't understand how this level of consolidation has been allowed in the healthcare market. I was affected by this, couldn't get prescriptions filled for 4 days. Turns out I'm not alone -- 100m people? That's 1/3rd of America's population! There is no competition in the marketplace. We need to either nationalize them or break them up. These ransomware groups are small-time compared to a nation-state adversary in wartime. At this point it's a national security issue.

kmeisthax 2y ago
Part of the neoliberal consensus that replaced progressive liberalism in the 1970s and 80s is a revisionist reframing of antitrust law in which all monopolies are judged solely by the yardstick of consumer welfare. Problem is, very few monopolies actually harm consumer welfare. Bigger businesses are able to deliver lower prices - at least initially - because they suck the redundancy out of the market. Ergo, consolidation is good actually and antitrust is self-defeating. Of course, those prices will creep up eventually, once the causal link between the consolidation and the market power has been sufficiently obscured. Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public. Because every business has only two or three real competitors, all of whom have extreme levels of class discipline and will agree to lie their asses off to the public. This level of consolidation was allowed because your politicians stabbed you in the back in the name of the """free""" market.
- sofixa 2y ago
  > Look at "inflation" - every business was able to blame "supply chain issues" (that they caused by removing redundancies) during COVID to extract unthinkable price increases out of the public. Are you implying there were no supply chain difficulties? China wasn't under heavy lockdown for months on end? There weren't ports with months of backlog? Factories weren't closed due to lockdowns or outbreaks all around the world? That civilian aviation ground to almost a complete halt for a few months, and the cargo it used to carry now didn't need to find an alternative route? Anyone trying to pin a singular reason for the inflation spikes after Covid is at best misinformed and arguing in bad faith. Covid wrecked supply chains, Russia's invasion of Ukraine wrecked a number of important raw materials' markets (oil, gas, nickel, grain, etc), the Houthis' shenanigans impacted the Suez Canal, droughts impacted the Panama canal. Sprinkle a heavy dose corporate greed and voilà, inflation.

albert_e 2y ago

[flagged]

AStonesThrow 2y ago
Definitely: all the other text in that image is AI-garbled. You can also tell, because the company name is not correctly stylized, nor is the correct font used, nor is their logo visible here. This is just a 100% fake AI building with some low-effort text slapped on afterwards. Why did they not actually bother to use a photograph of UHC's building? What did you expect from a site called "bleepingcomputer dot com"?

spoonfeeder006 2y ago

I always wonder that maybe someone can convince these health companies, clinics, etc... to start using Qubes OS for their network connected office computers. Maybe that could prevent a sizeable number of these ransomware attacks? TLDR Qubes OS is a security focused operating system that is geared towards end users. It relies on isolation via the Xen hypervisor (has much less privileged code than Linux, Windows, or Mac kernels), and uses hardware based virtualization features of the CPU as well. E.g. it prevents a compromised network card from accessing the memory of a trusted virtual machine through DMA attacks as an example And ultimately it incorporates this isolation into a seamless user interface as well I'm guessing the primary feature that would protect against ransomware is that it allows on to open suspicious links in disposable VMs

sofixa 2y ago
With the move of most enterprise software to web interfaces, this could be realistic for some organisation. Others, especially in healthcare, will have odd legacy thick clients developed in obscure languages decades ago that nobody wants to port.
hsbauauvhabzb 2y ago
Has there been any organisation to successfully roll this out, ever? It’s great for security, but useless from a productivity standpoint.
rty32 2y ago
Not sure using a different OS helps the issue, if not making it worse -- * These days hackers have a lot of resources and are often nation state actors. They utilize 0 day vulnerabilities. I don't see how an obscure OS will do any better than mainstream OS in terms of detecting and responding to exploits * Many hacks actually start with social engineering, and human becomes the weakest point (well, in some sense, it always has been) * Users, most of which are not computer experts, could make more mistakes when they are faced with software/interfaces they are not familiar with. (I'm just making this up, happy to see data that says otherwise.) "Open suspicious links in disposable VMs"? Sure, if they have received enough training and can do it perfectly, every single time, and never confuse the VM and the host environment. I'd say "never open suspicious links, forward the email to IT to help with you if needed", or even, just filtering untrusted domains in the email, is a much simpler and effective approach.

hulitu 2y ago

> UnitedHealth says data of 100M stolen in Change Healthcare hack "Privacy matters to Change Healthcare, so we follow a privacy framework that helps us to manage and protect your personal information in the products and services we provide." I guess this speaks for itself. /s

Rafuino 2y ago

My kid had their first data breach at 2 months old due to a healthcare company we've never heard of having their data and losing it to hackers. This whole industry needs to be burned to the ground.

deleted 2y ago

[deleted]

AIFounder 2y ago

[dead]