(Gabby Jones/Bloomberg via Getty Images)
The massive ransomware attack at UnitedHealth Group is projected to cost the company a staggering $2.3 billion to $2.5 billion.
The health insurance provider mentioned the estimate in a second-quarter earnings report on Tuesday. The $2 billion cost estimate is based on the millions UnitedHealth has already forked over to restore its systems from the attack, which caused a major outage in February.
The ensuing disruption also prevented UnitedHealth from processing medical prescriptions, which contributed to a drop in revenue, the company said in the earnings report.
In Q1, UnitedHealth originally estimated the ransomware attack would cost it between $1 billion to $1.2 billion. But in Tuesday’s earnings report, the company’s projections soared to over $2 billion, citing the need to pay “financial support initiatives and consumer notification costs,” which include offering loans and funding to affected hospitals and pharmacies.
In the second quarter alone, UnitedHealth also experienced “$1.1 billion in unfavorable cyberattack effects,” the company added.
The costs underscore the financial toll a major ransomware attack can have on a company—even when the ransom is paid. In UnitedHealth’s case, the company transferred over $22 million to the attackers, who also stole sensitive personal information on millions of Americans. But in April, a second ransomware gang claimed it was actually behind the attack and demanded the insurance provider pay up again.
UnitedHealth also continues to recover from the ransomware attack, although a “majority” of the company’s IT systems have been restored. In addition, several class-action lawsuits have been filed against UnitedHealth for failing to protect patient data. As a result, the ransomware attack's costs to the company could continue to balloon.