Cyberattack Disrupts Major U.S. Healthcare Network, Exposing Patient Data A ransomware attack on Change Healthcare, a key subsidiary of UnitedHealth Group, has severely disrupted healthcare operations across the U.S., highlighting vulnerabilities in critical medical infrastructure. The incident, first detected on February 21, 2024, forced the company to disconnect systems to contain the breach, leading to widespread delays in prescription processing, insurance claims, and payment systems for pharmacies, hospitals, and clinics. The attack, attributed to the BlackCat/ALPHV ransomware group, encrypted sensitive data and disrupted services for weeks, with some providers reporting ongoing issues into March. Change Healthcare processes 15 billion healthcare transactions annually, affecting roughly one in three U.S. patient records. While the full scope of compromised data remains unclear, early reports suggest personal and medical information may have been exfiltrated, raising concerns about potential identity theft and fraud. UnitedHealth Group confirmed the attack originated from a compromised credential, allowing threat actors to bypass security measures. The company has since restored some services, but the incident has drawn scrutiny from lawmakers and regulators, including the HHS Office for Civil Rights, which launched an investigation into potential HIPAA violations. The attack underscores the growing targeting of healthcare providers by cybercriminals, who exploit the sector’s reliance on interconnected systems and high-stakes data. As recovery efforts continue, the disruption has left patients facing delayed care and financial strain, while healthcare organizations grapple with operational and reputational fallout. The incident serves as a stark reminder of the cascading effects of cyberattacks on critical services.

AT&T deadline to file in part of a $177 million settlement is fast approaching. AP The deadline to file a claim in the massive $177 million AT&T data breach settlement is approaching fast. Eligible customers have about two weeks left to submit their claims before the Dec. 18 cutoff. The settlement stems from two AT&T data breaches in 2024, which occurred just months apart and exposed personal information for millions of current and former customers. What happened The first breach, in March 2024, leaked addresses, dates of birth, billing account numbers, passcodes, and Social Security numbers belonging to 7.6 million current and 65.4 million former AT&T customers. According to the settlement website, this information was released on the dark web. The second breach, in July 2024, exposed call and text records for about 110 million customers between 2022 and 2023. These records were “illegally downloaded from our workspace on a third-party cloud platform,” the settlement states. Multiple lawsuits followed, later consolidated and resolved with a settlement in the U.S. Northern District Court of Texas. How much money could you receive? Customers affected by either breach can file a claim, but payouts vary depending on which incident impacted them. Those affected by both breaches may qualify for up to $7,500. For those involved in the first breach, class members receive up to $5,000 if they can show the losses are “fairly traceable to the AT&T 1 Data Incident.” Remaini

Congress Moves to Strengthen Healthcare Cybersecurity After Change Healthcare Attack In the wake of the 2024 Change Healthcare cyberattack a breach that disrupted patient care and cost hospitals billions Congress is advancing bipartisan legislation to bolster cybersecurity across the healthcare sector. The attack exposed critical vulnerabilities, including the lack of multi-factor authentication and encryption, prompting lawmakers to act. The proposed bill, led by Sen. Bill Cassidy (R-La.), would require healthcare providers and government agencies to adopt stronger defenses, including mandatory multi-factor authentication and encryption. It also establishes grants for cyberattack preparedness and response planning, while improving coordination among federal agencies. The Department of Health and Human Services (HHS) would be tasked with developing a comprehensive incident response plan. Healthcare organizations, already under constant cyber threats, face unique risks due to the high value of medical data on the black market. Industry groups, including the Healthcare Trust Institute and Blue Cross Blue Shield Association, have voiced support, citing the life-or-death stakes of such breaches. However, hospitals and providers may push back against certain requirements, wary of additional costs amid existing cybersecurity investments. While earlier versions of the legislation proposed stricter penalties, the current bill takes a more moderate approach to secure broader support. Still, its fate remains uncertain, as Congress faces a packed agenda and limited time before the midterm elections. The Senate Health Committee advanced the measure in a 22-1 vote last month, but its final passage may hinge on attachment to a larger legislative package, such as a year-end funding deal. With healthcare breaches costing an average of $10 million per incident the highest among all industries the push for stronger protections reflects growing urgency. Yet, political divisions and competing priorities could delay or derail the effort.