Change Healthcare on Thursday confirmed that ransomware group Blackcat is behind the ongoing cybersecurity attack that’s caused widespread disruptions to pharmacies and health systems across the U.S.
“Our experts are working to address the matter and we are working closely with law enforcement and leading third-party consultants,” Change Healthcare told CNBC in a statement Thursday. “We are actively working to understand the impact to members, patients and customers.”
The company said it’s working with Mandiant, which is owned by Google, and cybersecurity software vendor Palo Alto Networks.
In a since-deleted post on the dark web, Blackcat said Wednesday that it was behind the attack on Change Healthcare’s systems. The group said it managed to extract six terabytes of data, including information like medical records, insurance records and payment information.
Change’s parent company UnitedHealth Group said it discovered that a cyber threat actor breached part of the unit’s information technology network on Feb. 21, according to a filing with the SEC. UnitedHealth isolated and disconnected the impacted systems “immediately upon detection” of the threat, the filing said, but it didn’t disclose the nature of the attack or exactly when it took place.
Blackcat, also called Noberus and ALPHV, steals sensitive data from institutions and threatens to publish it unless a ransom is paid, according to a December release from the U.S. Department of Justice. Blackcat has compromised computer networks across the U.S. and the globe, amounting to hundreds of millions of dollars in losses, the release said.
Change Healthcare offers tools for payment and revenue cycle management that help facilitate transactions like reimbursement payments. In 2022, it merged with the health-care provider Optum, which services more than 100 million patients in the U.S. and is owned by UnitedHealth, the country’s biggest health-care company by market cap.
Brett Callow, a threat analyst at the cybersecurity company Emsisoft, said ransomware groups will often make posts like these in an effort to bring victims to the negotiating table. Callow, who specializes in ransomware, shared a screenshot of Blackcat’s deleted post to the social media site X on Wednesday.
He said ransomware groups often exaggerate the amount of data they’ve stolen, so Blackcat’s claims should be treated with skepticism. It can take weeks for an organization to determine exactly what information was stolen, he added, and ransomware groups often use the period of uncertainty to their advantage.
“Cybercriminals, they’re not going to tell the truth,” Callow told CNBC in an interview.
UnitedHealth said in its filing with the SEC that it suspected a nation-state-associated actor was behind the attack, but Callow said Blackcat is a for-profit cybercrime operation. He called the discrepancy “peculiar,” but said there might be more to the breach that he doesn’t know about.
Ransomware attacks can be particularly dangerous within the health-care sector, as they can cause immediate harm to patients’ physical safety, said John Riggi, national advisor for cybersecurity and risk at the American Hospital Association.
When systems go dark, diagnostic technologies like CT scanners can go offline, and ambulances carrying patients are often diverted, which can delay lifesaving care, he said.
“Change, they’re a victim,” Riggi told CNBC. “Ultimately, though, this was not an attack just on them, this was an attack on the entire health-care sector.”
Change Healthcare’s systems have been down for nine straight days, and it’s unclear when they will come back online.
The SEC filed a lawsuit against Elon Musk on Tuesday, alleging the billionaire committed securities fraud in 2022 by failing to disclose his ownership in Twitter and buying shares at “artificially low prices.”
Musk, who is also CEO of Tesla and SpaceX, purchased Twitter for $44 billion, later changing the name of the social network to X. Prior to the acquisition he’d built up a position in the company of greater than 5%, which would’ve required disclosing his holding to the public.
According to the SEC complaint, filed in U.S. District Court in Washington, D.C., Musk withheld that material information, “allowing him to underpay by at least $150 million for shares he purchased after his financial beneficial ownership report was due.”
The SEC had been investigating whether Musk, or anyone else working with him, committed securities fraud in 2022 as the Tesla CEO sold shares in his car company and shored up his stake in Twitter ahead of his leveraged buyout. Musk said in a post on X last month that the SEC issued a “settlement demand,” pressuring him to agree to a deal including a fine within 48 hours or “face charges on numerous counts” regarding the purchase of shares.
Musk’s lawyer, Alex Spiro, said in an emailed statement that the action is an admission by the SEC that “they cannot bring an actual case.” He added that Musk “has done nothing wrong” and called the suit a “sham” and the result of a “multi-year campaign of harassment,” culminating in a “single-count ticky tak complaint.”
Musk is just a week away from having a potentially influential role in government, as President-elect Donald Trump’s second term begins on Jan. 20. Musk, who was a major financial backer of Trump in the latter stages of the campaign, is poised to lead an advisory group that will focus in part on reducing regulations, including those that affect Musk’s various companies.
In July, Trump vowed to fire SEC chairman Gary Gensler. After Trump’s election victory, Gensler announced that he would be resigning from his post instead.
In a separate civil lawsuit concerning the Twitter deal, the Oklahoma Firefighters Pension and Retirement System sued Musk, accusing him of deliberately concealing his progressive investments in the social network and intent to buy the company. The pension fund’s attorneys argued that Musk, by failing to clearly disclose his investments, had influenced other shareholders’ decisions and put them at a disadvantage.
The SEC said that Musk crossed the 5% ownership threshold in March 2022 and would have been required to disclose his holdings by March 24.
“On April 4, 2022, eleven days after a report was due, Musk finally publicly disclosed his beneficial ownership in a report with the SEC, disclosing that he had acquired over nine percent of Twitter’s outstanding stock,” the complaint says. “That day, Twitter’s stock price increased more than 27% over its previous day’s closing price.”
The SEC alleges that Musk spent over $500 million purchasing more Twitter shares during the time between the required disclosure and the day of his actual filing. That enabled him to buy stock from the “unsuspecting public at artificially low prices,” the complaint says. He “underpaid” Twitter shareholders by over $150 million during that period, according to the SEC.
In the complaint, the SEC is seeking a jury trial and asks that Musk be forced to “pay disgorgement of his unjust enrichment” as well as a civil penalty.
Intel said Tuesday that it plans to spin off Intel Capital, its venture capital wing, into an independent firm, the latest in a series of structural changes announced by the chipmaker.
Turning Intel Capital, which has $5 billion in assets, into a standalone fund will allow it to raise money from outside investors, Intel said. Until now, the venture arm has been fully funded by Intel.
Intel is coming off its worst year on the stock market since the company went public in 1971 due to a series of missteps and hefty market share losses. The company has been cutting costs and simplifying its business as it spends heavily to build cutting-edge chip factories while vying to reinvigorate its PC chip unit.
In December, Intel ousted Pat Gelsinger as CEO following a troubled four-year tenure. He’s been replaced by two interim co-CEOs, David Zinzner and Michelle Holthaus.
Intel sold or wound down a slew of smaller divisions in the past two years under Gelsinger, and laid off employees last year as part of a cost-cutting plan.
Intel is currently spinning off Altera, a company that specializes in simple chips called FPGAs, with plans for it to become a publicly traded company. It also owns the majority of Mobileye, an Israel-based maker of self-driving parts and software. Last year, Intel took several steps in the direction of turning its foundry business into an independent unit, including naming a board of directors.
In Tuesday’s announcement, the company said Intel Capital’s workforce would continue with the investment firm when it becomes independent in the second half of 2025. A representative declined to comment on specific executives’ plans. Intel Capital could also be renamed.
Intel Capital was established in 1991 and was unique at the time as a venture arm of a large corporation.
Since then, that model has been replicated across Silicon Valley and in other industries, with companies including Google, Microsoft, Salesforce, Unilever and BMW jumping into the business. Comcast, the owner of CNBC’s parent, NBCUniversal, started Comcast Ventures in 1999.
While Intel was early to corporate venture capital, it isn’t the first tech company to spin out its investment arm. In 2011, SAP turned SAP Ventures into an independent firm, later naming it Sapphire Ventures.
Corporate venture capital peaked in 2021, when firms in the space raised $156 billion and participated in close to 3,800 deals, according to the National Venture Capital Association. That was the same year that the broader VC market hit record levels, but startup investment numbers have since declined dramatically due largely to higher interest rates, which began going up in 2022.
Executive Chair and CEO of Microsoft Corporation Satya Nadella speaks during the “Microsoft Build: AI Day” event in Jakarta, Indonesia, on April 30, 2024.
Ajeng Dinar Ulfiana | Reuters
Microsoft plans to pause hiring in part of its consulting business in the U.S., according to an internal memo, as the company continues seeking ways to reel in expenses.
The announced cuts come a week after Microsoft said it would lay off some employees. Those cuts will affect less than 1% of the company’s workforce, according to one person familiar with Microsoft’s plans.
Although Microsoft indicated earlier this month that it plans to continue investing in its artificial intelligence efforts, cost cuts elsewhere could lead to gains for the company’s stock price. Microsoft shares increased 12% in 2024, compared with a 29% boost for the Nasdaq Composite index.
The changes by the U.S. consulting division are meant to align with a policy by the Microsoft Customer and Partner Solutions organization, which has about 60,000 employees, according to a page on Microsoft’s website. The changes are in place through the remainder of the 2025 fiscal year ending in June.
To reduce costs, Microsoft’s consulting division will hold off on hiring new employees and back-filling roles, consulting executive Derek Danois told employees in the memo. Careful management of costs is of utmost importance, Danois wrote.
The memo also instructs employees to not expense travel for any internal meetings and use remote sessions instead. Additionally, executives will have to authorize trips to customers’ sites to ensure spending is being used on the right customers, Danois wrote.
Additionally, the group will cut its marketing and non-billable external resource spend by 35%, the memo says.
The consulting division has grown more slowly than Microsoft’s productivity software subscriptions and Azure cloud computing businesses. The consulting unit generated $1.9 billion in the September quarter, down about 1% from one year earlier, compared with 33% for Azure.
Under the leadership of CEO Satya Nadella, Microsoft in early 2023 laid off 10,000 employees and consolidated leases as the company contended with a broader shift in the market and economy. In January 2024, three months after completing the $75.4 billion Activision Blizzard acquisition, Microsoft’s gaming unit shed 1,900 jobs to reduce overlap.
A Microsoft spokesperson did not immediately have a comment.