(Photo by Jakub Porzycki/NurPhoto via Getty Images)
The hackers behind a February breach of UnitedHealth Group subsidiary Change Healthcare appear to have stolen a huge trove of sensitive information.
Change Healthcare on Thursday published an official notice about the hack, which may have affected "a third" of Americans. The company isn't offering an exact count of the number of affected consumers but admits the hackers stole a "substantial quantity of data."
It's also unclear what kind of data was looted. But the company says the stolen information may include full names, physical addresses, dates of birth, phone numbers, and email addresses.
Other data that could have been stolen include health insurance information, medical record numbers, diagnoses, test results, along with payment card and banking information. In addition, the hackers may have also taken people’s Social Security numbers, driver’s license ID numbers, and passport numbers.
“The information that may have been involved will not be the same for every impacted individual,” the company says. “To date, we have not yet seen full medical histories appear in the data review.”
(Credit: Change Healthcare)In the wrong hands, the stolen information could be easily exploited to conduct identity theft schemes and other scams. The company provided the information as it prepared to send out official data breach notices to affected customers.
Hackers tied to the ransomware group ALPHV took credit for the breach, which allegedly involved 6,000GB of data. UnitedHealth Group then paid the group a $22 million ransom to prevent the data from leaking. But in April, a second hacking group, called Ransomhub, demanded another ransom, alleging it was behind the original intrusion into Change Healthcare.
It's unclear if UnitedHealth Group paid the second ransom. But even if it did, there’s no guarantee that the hackers kept the data to themselves — especially when selling the information could help them make more money.
In the meantime, Change Healthcare will offer affected users “two years of complimentary credit monitoring and identity protection services.”