UnitedHealth Group Unplugs Change Healthcare Information Systems To Contain Cyberattack

UnitedHealth Group disconnected Change Healthcare's information system to contain a cyberattack that the company says is from an unnamed “nation-state associated cyber security threat actor.”

The Change Healthcare outage appeared to be affecting mainly pharmacies throughout the country, according to multiple media accounts and social media posts, although other healthcare organizations were taking precautions to limit any damage or infiltration of their information system.

UnitedHealth said in a Securities and Exchange Commission filing yesterday that on Wednesday [Feb. 21] that it had identified that a “nation-state associated cyber security threat actor” had gained access to Change Health’s information systems.

Change Healthcare manages revenue cycles and has a variety of healthcare analytics products. It is also an important pharmacy claims processing service that connects pharmacies and other places where prescriptions are ordered and filled to pharmacy benefit managers (PBMs) that managed and pay those claims. UnitedHealth Group and its subsidiary, Optum, acquired Change Healthcare when it was a separate company in a deal that was closed in 2022. It is now part of Optum, the health services division of Minnesota-based UnitedHealth. The U.S. Department of Justice initially sought to block the acquisition on antitrust and other grounds but when courts ruled in UnitedHealth's favor, it dropped the legal challenge.

Stat reported earlier today that the FBI, the Cybersecurity and Infrastructure Agency, and the Department of Health and Human Services had scheduled a call this afternoon with executives at UnitedHealth, the American Hospital Association and the Health Information Sharing and Analysis Center to discuss the cyberattack.

A status update at 2:20 p.m. Eastern Standard Time (EST) today on an Optum website said the company had “a high-level of confidence that Optum, UnitedHealthcare and UnitedHealth Group systems have not been affected by this issue.”

The first status update at 2:15 a.m. EST on Wednesday refers only to some applications not being unavailable. Approximately three hours later, at 5:05 a.m. EST, an update says that “we are currently experiencing enterprise-wide connectivity issues.”

The first mention of Change Healthcare and a cyber security issue occurred in an update at 2:09 p.m. EST on Wednesday. It says: “Change Healthcare is experiencing a network interruption related to a cyber security issue and our security experts are working to address the matter.”

An update a little over two hours later, at 4:27 p.m. EST adds that once the outside threat was discovered “in the interest of protecting our partners and patients, we took immediate action to disconnect our systems to prevent further impact.”

“Our systems” refers to Change Healthcare. That update also says, “The disruption is expected to last at least through the day.”

Yesterday at 11:32 a.m. EST the wording was revised to highlight that the problem was limited to Change Healthcare. That update says that “we believe the issue is specific to Change Healthcare and all other systems across UnitedHealth Group are operational” and that wording has been repeated in updates since.

Small independent pharmacies seem to have been affected the most by the abrupt disconnection of Change Healthcare, although that appearance may be related to social media presence.

“Unfortunately, we are at the mercy of Change Healthcare while they work to resolve this national outage,” reads the Facebook page of Heartland Family Pharmacy, located in Auburn, Kentucky. “We have not been given a timeframe for restoration of service at this time.”

Many Departments of Defense pharmacies were also affected, including the Brooke Army Medical Center, USAFA Pharmacy, and the Bassett Army Community Hospital.