Change Healthcare Archives

Blockchain startups were red-hot when Katie Haun left Andreessen Horowitz in 2021 to launch her own crypto-focused venture firm. But shortly after Haun announced that Huan Ventures’ two funds totalled $1.5 billion, cryptocurrency prices cratered, and FTX collapsed.

Despite having a massive arsenal of dry powder, Haun Ventures didn’t rush to scoop up stakes in crypto and web3 on the cheap, and many observers wondered when the firm would pick up its deployment pace.

While Haun Ventures says it wasn’t exactly sitting on its hands (and capital) through crypto’s downturn, the firm was perhaps more cautious than it initially intended.

But now that bitcoin prices have rebounded to their previous highs, Haun Ventures’ investment activity is increasing dramatically. Including some of its token positions, the firm has made 48 investments across its early-stage $500 million and $1 billion later-stage acceleration funds, Haun Ventures told TechCrunch.

The firm’s latest investment is Agora, an app that streamlines voting and other decision-making for decentralized autonomous organizations. The firm led a $5 million seed round into Agora on Tuesday, with participation from Seed Club, Coinbase Ventures, Balaji Srinivasan and others.

Sam Rosenblum, a partner and investment team lead at Haun Ventures, said that a significant impediment to DAO participation had been the lack of a simple user interface that allows members to approve (or vote on) the implementation of software upgrades to the protocols they are governing.

The process was highly fragmented. Certain decisions were made in a separate Discord channel, then “you then [the community would] go somewhere else to take a vote on allocating dollars in the treasury towards a certain project,” Rosenblum said.

Agora solves this issue for DAO members by providing an easy-to-use community and protocol governance solution. “Historically, if you wanted to participate in resource allocation of a protocol treasury, you had to do a bunch of on-chain actions yourself, which probably means you have hardware and software setup that most people don’t have,” Rosenblum said.

Agora is supposed to make DAO participation straightforward for non-technical users. Rosenblum compared it to Coinbase, which simplified coin trading for most people.

The company was founded in 2022 by Charlie Feng, who co-founded fintech Clearco; Coinbase product designer Yitong Zhang; and software engineer Kent Fenwick.

Agora, which is essentially a SaaS offering, is already used by protocols such as Optimism, ENS and Uniswap.

Rosenblum explained that these protocols are happy to pay for Agora because it helps lower the barrier to participation in their community.

While activity is certainly accelerating in the crypto world, Rosenblum didn’t say exactly when Haun Ventures will be done deploying its current fund. But he did say that investing will continue into next year.

Software Development in Sri Lanka

Robotic Automations

UnitedHealth CEO tells Senate all systems now have multi-factor authentication after hack | TechCrunch

May 2, 2024 3:06 AM0

UnitedHealth Group Chief Executive Officer Andrew Witty told senators on Wednesday that the company has now enabled multi-factor authentication on all the company’s systems exposed to the internet in response to the recent cyberattack against its subsidiary Change Healthcare.

The lack of multi-factor authentication was at the center of the ransomware attack that hit Change Healthcare earlier this year, which impacted pharmacies, hospitals and doctors’ offices across the United States. Multi-factor authentication, or MFA, is a basic cybersecurity mechanism that prevents hackers from breaking into accounts or systems with a stolen password by requiring a second code to log in.

In a written statement submitted on Tuesday ahead of two congressional hearings, Witty revealed that hackers used a set of stolen credentials to access a Change Healthcare server, which he said was not protected by multi-factor authentication. After breaking into that server, the hackers were then able to move into other company systems to exfiltrate data, and later encrypt it with ransomware, Witty said in the statement.

Today, during the first of those two hearings, Witty faced questions about the cyberattack from senators on the Finance Committee. In response to questions by Sen. Ron Wyden, Witty said that “as of today, across the whole of UHG, all of our external-facing systems have got multi-factor authentication enabled.”

“We have an enforced policy across the organization to have multi-factor authentication on all of our external systems, which is in place,” Witty said.

When asked to confirm Witty’s statement, UnitedHealth Group’s spokesperson Anthony Marusic told TechCrunch that Witty “was very clear with his statement.”

Witty blamed the fact that Change Healthcare’s systems had not yet been upgraded after UnitedHealth Group acquired the company in 2022.

“We were in the process of upgrading the technology that we had acquired. But within there, there was a server, which I’m incredibly frustrated to tell you, was not protected by MFA,” Witty said. “That was the server through which the cybercriminals were able to get into Change. And then they led off a ransomware attack, if you will, which encrypted and froze large parts of the system.”

Contact Us

Do you have more information about the Change Healthcare ransomware attack? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email . You also can contact TechCrunch via SecureDrop.

Witty also said that the company is still working on understanding exactly why that server did not have multi-factor authentication enabled.

Wyden criticized the company’s failure to upgrade the server. “We heard from your people that you had a policy, but you all weren’t carrying it out. And that’s why we have the problem,” Wyden said.

UnitedHealth has yet to notify people that were impacted by the cyberattack, Witty said during the hearing, arguing that the company still needs to determine the extent of the hack and the stolen information. As of now, the company has only said that hackers stole personal and health information data of “a substantial proportion of people in America.”

Last month, UnitedHealth said that it paid $22 million to the hackers who broke into the company’s systems. Witty confirmed that payment during the Senate hearing.

On Tuesday afternoon, Witty also appeared in a House Energy and Commerce committee, where he revealed that “maybe a third” of Americans had their personal health information stolen by the hackers

Software Development in Sri Lanka

Robotic Automations

United HealthCare CEO says 'maybe a third' of U.S. citizens were affected by recent hack | TechCrunch

May 2, 2024 1:19 AM0

Two months after hackers broke into Change Healthcare systems stealing and then encrypting company data, it’s still unclear how many Americans were impacted by the cyberattack.

Last month, Andrew Witty, the CEO of Change Healthcare’s parent company UnitedHealth Group, said that the stolen files include the personal health information of “a substantial proportion of people in America.”

On Wednesday, during a House hearing, when Witty was pushed to give a more definitive answer, testifying that the breach impacted “I think, maybe a third [of Americans] or somewhere of that level.”

Witty said he was reluctant to give a more precise answer because the company is still investigating the breach and trying to figure out exactly how many people were affected.

UnitedHealth’s spokesperson Anthony Marusic did not immediately respond to a request for comment on Witty’s estimate.

During a hearing in the Senate earlier on Wednesday, Witty said that it will likely take “several months,” before the company can begin notifying victims of the data breach.

In a written statement filed by Witty ahead of the two hearings, the CEO wrote that “so far, we have not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.”

According to Witty’s testimony, the hackers “used compromised credentials to remotely access a Change Healthcare Citrix portal,” which was not protected by multi-factor authentication, a basic cybersecurity measure that adds an extra step to log into accounts and systems.

Had that portal had multi-factor authentication enabled, the breach may not have happened. Several Senators grilled Witty on that failure, asking him whether UnitedHealth and Change Healthcare systems are now protected with multi-factor authentication.

During the Senate hearing, Witty said: “We have an enforced policy across the organization to have multi factor authentication on all of our external systems, which is in place.”

The House hearing is underway as of this writing, and we will update this story as more information becomes available.

Software Development in Sri Lanka

Robotic Automations

Change Healthcare hackers broke in using stolen credentials — and no MFA, says UHG CEO | TechCrunch

April 30, 2024 4:59 PM0

The ransomware gang that hacked into U.S. health tech giant Change Healthcare used a set of stolen credentials to remotely access the company’s systems that weren’t protected by multi-factor authentication, according to the chief executive of its parent company, UnitedHealth.

UnitedHealth CEO Andrew Witty provided the written testimony ahead of a House subcommittee hearing on Wednesday into the February ransomware attack that caused months of disruption across the U.S. healthcare system.

This is the first time the health insurance giant has given an assessment of how hackers broke into Change Healthcare’s systems, during which massive amounts of health data were exfiltrated from its systems. UnitedHealth said last week that the hackers stole health data on a “substantial proportion of people in America.”

Change Healthcare processes health insurance and billing claims for around half of all U.S. residents.

According to Witty’s testimony, the criminal hackers “used compromised credentials to remotely access a Change Healthcare Citrix portal.” Organizations like Change use Citrix software to let employees access their work computers remotely on their internal networks. Witty did not elaborate on how the credentials were stolen.

However, Witty did say the portal “did not have multi-factor authentication,” which is a basic security feature that prevents the misuse of stolen passwords by requiring a second code sent to an employee’s trusted device, such as their phone. It’s not known why Change did not set up multi-factor authentication on this system, but this will likely become a focus for investigators trying to understand potential deficiencies in the insurer’s systems.

“Once the threat actor gained access, they moved laterally within the systems in more sophisticated ways and exfiltrated data,” said Witty.

Witty said the hackers deployed ransomware nine days later on February 21, prompting the health giant to shut down its network to contain the breach.

UnitedHealth confirmed last week that the company paid a ransom to the hackers who claimed responsibility for the cyberattack and the subsequent theft of terabytes of stolen data. The hackers, known as RansomHub, are the second gang to lay claim to the data theft after posting a portion of the stolen data to the dark web and demanding a ransom to not sell the information.

UnitedHealth earlier this month said the ransomware attack cost it more than $870 million in the first quarter, in which the company made close to $100 billion in revenue.

UnitedHealth says Change hackers stole health data on ‘substantial proportion of people in America’

Software Development in Sri Lanka

Robotic Automations

Health insurance giant Kaiser notifies millions of a data breach | TechCrunch

April 26, 2024 1:19 AM0

U.S. health conglomerate Kaiser is notifying millions of its members of a data breach earlier this month.

In a legally required notice filed with the U.S. government on April 12 but made public on Thursday, the Kaiser Foundation Health Plan confirmed that 13.4 million residents had information taken in a data breach.

The notice did not share the specific nature of the data breach, describing the incident only as “unauthorized access/disclosure” involving a network server.

U.S. organizations covered under the health privacy law known as HIPAA are required to notify the U.S. Department of Health and Human Services of data breaches involving protected health information, such as medical data and patient records. Kaiser also notified California’s attorney general of the data breach, but did not provide any further details.

Kaiser spokesperson Catherine Hernandez did not respond to a request for comment Thursday.

The Kaiser Foundation Health Plan is the parent organization of several entities that make up Kaiser Permanente, one of the largest healthcare organizations in the United States. The Kaiser Foundation Health Plan provides health insurance plans to employers and reported 12.5 million members as of the end of 2023.

The breach at Kaiser is listed on the Department of Health and Human Services’ website as the largest confirmed health-related data breach of 2024 so far.

It’s unclear if the breach at Kaiser is related to the ongoing recovery at U.S. health tech giant Change Healthcare, which was hit by ransomware in February. Earlier this week, Change Healthcare’s parent company UnitedHealth Group said that the criminal hackers stole sensitive health information on a “substantial proportion of people in America,” but fell short of providing a clear figure.

Do you know more about the data breach at Kaiser? To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.

Software Development in Sri Lanka

Robotic Automations

UnitedHealth says Change hackers stole health data on 'substantial proportion of people in America' | TechCrunch

April 23, 2024 4:16 AM0

Health insurance giant UnitedHealth Group has confirmed that a ransomware attack on its health tech subsidiary Change Healthcare earlier this year resulted in a huge theft of Americans’ private healthcare data.

UnitedHealth said in a statement on Monday that a ransomware gang took files containing personal data and protected health information that it says may “cover a substantial proportion of people in America.”

The health insurance giant did not say how many Americans are affected but said the data review was “likely to take several months” before the company would begin notifying individuals that their information was stolen in the cyberattack.

Change Healthcare processes insurance and billing for hundreds of thousands of hospitals, pharmacies and medical practices across the U.S. healthcare sector; it has access to massive amounts of health information on about half of all Americans.

UnitedHealth said it had not yet seen evidence that doctors’ charts or full medical histories were exfiltrated from its systems.

The admission that hackers stole Americans’ health data comes a week after a new hacking group began publishing portions of the stolen data in an effort to extort a second ransom demand from the company.

The gang, which calls itself RansomHub, published several files on its dark web leak site containing personal information about patients across an array of documents, some of which included internal files related to Change Healthcare. RansomHub said it would sell the stolen data unless Change Healthcare pays a ransom.

RansomHub is the second gang to demand a ransom from Change Healthcare. The health tech giant reportedly paid $22 million to a Russia-based criminal gang called ALPHV in March, which then disappeared, stiffing the affiliate that carried out the data theft out of their portion of the ransom.

RansomHub claimed in its post alongside the published stolen data that “we have the data and not ALPHV.”

In its statement Monday, UnitedHealth acknowledged the publication of some of the files but stopped short of claiming ownership of the documents. “This is not an official breach notification,” UnitedHealth said.

The Wall Street Journal reported Monday that the criminal hacking affiliate of ALPHV broke into Change Healthcare’s network using stolen credentials for a system that allows remote access to its network. The hackers were in Change Healthcare’s network for more than a week before deploying ransomware, allowing the hackers to steal significant amounts of data from the company’s systems.

The cyberattack at Change Healthcare began on February 21 and resulted in ongoing widespread outages at pharmacies and hospitals across the United States. For weeks, physicians, pharmacies and hospitals could not verify patient benefits for dispensing medications, organizing inpatient care, or processing prior authorizations necessary for surgeries.

Much of the U.S. healthcare system ground to a halt, with healthcare providers facing financial pressure as backlogs grow and outages linger.

UnitedHealth reported last week that the ransomware attack has cost it more than $870 million in losses. The company reported it made $99.8 billion in revenue during the first three months of the year, faring better than what Wall Street analysts had expected.

UnitedHealth CEO Andrew Witty, who received close to $21 million in total compensation the full year of 2022, is set to testify to House lawmakers on May 1.

Change Healthcare stolen patient data leaked by ransomware gang

Software Development in Sri Lanka

Robotic Automations

Change Healthcare stolen patient data leaked by ransomware gang | TechCrunch

April 16, 2024 2:47 AM0

An extortion group has published a portion of what it says are the private and sensitive patient records on millions of Americans stolen during the ransomware attack on Change Healthcare in February.

On Monday, a new ransomware and extortion gang that calls itself RansomHub published several files on its dark web leak site containing personal information about patients across different documents, including billing files, insurance records and medical information.

Some of the files, which TechCrunch has seen, also contain contracts and agreements between Change Healthcare and its partners.

RansomHub threatened to sell the data to the highest bidder unless Change Healthcare pays a ransom.

It’s the first time that cybercriminals have published evidence that they have in their possession medical and patient records from the cyberattack.

For Change Healthcare, there’s another complication: This is the second group to demand a ransom payment to prevent the release of stolen patient data in as many months.

UnitedHealth Group, the parent company of Change Healthcare, said there was no evidence of a new cyber incident. “We are working with law enforcement and outside experts to investigate claims posted online to understand the extent of potentially impacted data. Our investigation remains active and ongoing,” said Tyler Mason, a spokesperson for UnitedHealth Group.

What’s more likely is that a dispute between members and affiliates of the ransomware gang left the stolen data in limbo and Change Healthcare exposed to further extortion.

A Russia-based ransomware gang called ALPHV took credit for the Change Healthcare data theft. Then, in early March, ALPHV suddenly disappeared along with a $22 million ransom payment that Change Healthcare allegedly paid to prevent the public release of patient data.

An ALPHV affiliate — essentially a contractor who earns a commission on the cyberattacks they launch using the gang’s malware — went public claiming to have carried out the data theft at Change Healthcare, but that the main ALPHV/BlackCat crew stiffed them out of their portion of the ransom payment and vanished with the lot. The contractor said the millions of patients’ data was “still with us.”

Now, RansomHub says “we have the data and not ALPHV.” Wired, which first reported the second group’s extortion effort on Friday, cited RansomHub as saying it was associated with the affiliate that still had the data.

UnitedHealth previously declined to say whether it paid the hackers’ ransom, nor did it say how much data was stolen in the cyberattack.

The healthcare giant said in a statement on March 27 that it obtained a dataset “safe for us to access and analyze,” which the company obtained in exchange for the ransom payment, TechCrunch learned from a source with knowledge of the ongoing incident. UHG said it was “prioritizing the review of data that we believe would likely have health information, personally identifiable information, claims and eligibility or financial information.”

As the Change Healthcare outage drags on, fears grow that patient data could spill online

Software Development in Sri Lanka

Robotic Automations

A ransomware gang is leaking Change Healthcare's stolen patient data | TechCrunch

April 16, 2024 2:15 AM0