(Photo by Jakub Porzycki/NurPhoto via Getty Images)
As UnitedHealth Group continues to recover from February’s ransomware attack, the company is facing a new potential threat. A second hacking group is demanding the health insurance provider pay another ransom or else it’ll sell the company’s stolen data to the highest bidder.
The threat comes from a hacking gang called RansomHub, which emerged in February. It now claims to have stolen 4TB of data from UnitedHealth’s Change Healthcare subsidiary, including the personal details and medical records of "millions" of patients.
"Change Healthcare and United Health you have one chance in protecting your clients data," RansomHub wrote on its site on the dark web. "The data has not been leaked anywhere and any decent threat intelligence would confirm that the data has not been shared nor posted."
Although the group appears to be new, RansomHub is implying it's behind the original February attack, which it pulled off while working as an affiliate member under the ALPHV/Blackcat ransomware gang.
Back then, ALPHV made its own ransom demand to UnitedHealth, claiming it had stolen 6TB of company data. In response, there’s evidence that UnitedHealth paid a $22 million ransom to ALPHV. The only problem is that ALPHV allegedly swindled the $22 million payment, without sharing the profits with the affiliate member that pulled off the attack. ALPHV has since shut down its operations.
(Credit: RansomHub)Hence, it’s possible the demand from RansomHub comes from the same affiliate member that originally breached UnitedHealth. In a post on their website, the group claims that: “ALPHV stole the ransom payment (22 Million USD) that Change Healthcare and United Health [paid] in order to restore their systems and prevent the data leak. HOWEVER we have the data and not ALPHV.”
Still, other security researchers say it’s possible that RansomHub is lying, since the group hasn’t posted any sample of the stolen data. Another possibility is that RansomHub is a rebrand of the ALPHV gang itself.
"If we had to guess, we would guess the ransomware affiliate from ALPHV simply moved over to RansomHub and want to collect their approx. $17,600,000 (80% of the original payment) they believed they're due," tweeted Vx Underground, a malware library site.
In a statement, UnitedHealth merely said: "We are aware of these reports and continue to work with the authorities." But if the claims from RansomHub are legit, then the health insurance provider will have to once again weigh paying the ransom or not. So far, the company hasn’t confirmed or denied it paid $22 million to ALPHV.