Updated on Feb. 27 to include new company statements.
A cyberattack on a unit affiliated with UnitedHealthcare, the nation’s largest insurer, has disrupted drug prescription orders at thousands of pharmacies for about a week.
The assault on the unit, Change Healthcare, a division of United’s Optum, was discovered last Wednesday. The attack appeared to be by a foreign country, according to two senior federal law enforcement officials, who expressed alarm at the extent of the disruption on Monday.
UnitedHealth Group, the conglomerate, said in a federal filing that it had been forced to disconnect some of Change Healthcare’s vast digital network from its clients, and as of Tuesday, had not been able to restore all of those services. The company has not provided any timetable for when it may be able to reconnect.
Change handles some 15 billion transactions a year, representing as many as one in three U.S. patient records and involving not just prescriptions but dental, clinical and other medical needs. The company was acquired by UnitedHealth Group for $13 billion in 2022.
This latest attack underscores the vulnerability of health care data, especially patients’ personal information, including their private medical records. Hundreds of breaches at hospitals, health plans and doctors’ offices are being investigated, according to federal records.
Federal officials say they are closely monitoring the situation. “This incident serves as yet another reminder of the interconnectedness of the domestic health care ecosystem and of the urgency of strengthening cybersecurity resiliency across the ecosystem,” said Jeff Nesbit, a spokesman for the U.S. Department of Health and Human Services, which said it is in touch with other federal agencies.
