UnitedHealth Group has paid more than $3 billion to providers following cyberattack
In this photo illustration the UnitedHealth Group logo displayed on a smartphone screen.
Sheldon Cooper | Sopa Images | Lightrocket | Getty Images
UnitedHealth Group has paid out an additional $1 billion to providers that have been impacted by the Change Healthcare cyberattack since last week, bringing the total amount of funds advanced to more than $3.3 billion, the company said on Wednesday.
UnitedHealth, which owns Change Healthcare, discovered in February that a cyber threat actor had breached part of the unit’s information technology network. Change Healthcare processes more than 15 billion billing transactions annually, and one in every three patient records passes through its systems, according to its website.
The company disconnected the affected systems “immediately upon detection” of the threat, according to a filing with the SEC. The interruptions left many health-care providers temporarily unable to fill prescriptions or get reimbursed for their services by insurers.
Many health-care providers rely on reimbursement cash flow to operate, so the fallout has been substantial. Smaller and mid-sized practices told CNBC they were making tough decisions about how to stay afloat. A survey published by the American Hospital Association earlier this month found that 94% of hospitals have experienced financial disruptions from the attack.
As a result, UnitedHealth introduced its temporary funding assistance program to help providers in need of support. The company said the $3.3 billion in advances will not need to be repaid until claims flows return to normal. Federal agencies like the Centers for Medicare & Medicaid Services have introduced additional options to ensure that states and other stakeholders can make interim payments to providers, according to a release.
UnitedHealth has been working to restore Change Healthcare’s systems in recent weeks, and it expects some disruptions will continue into April, according to its website. The company began processing a backlog of more than $14 billion in claims on Friday, and on Wednesday said, “claims have begun to flow.”
Shares of UnitedHealth have fallen more than 6% since the attack was disclosed.
Late last month, the company said the ransomware group Blackcat is behind the attack. Blackcat, also called Noberus and ALPHV, steals sensitive data from institutions and threatens to publish it unless a ransom is paid, according to a December release from the U.S. Department of Justice.
The Department of State on Wednesday announced it’s offering a reward of up to $10 million for information that could help identify or locate cyber actors linked to Blackcat.
UnitedHealth said Wednesday that it’s “still determining the content of the data that was taken by the threat actor.” The company said a “leading vendor” is analyzing the impacted data. United Health is working closely with law enforcement and third parties like Palo Alto Networks and Google‘s Mandiant to assess the attack.
“We continue to be vigilant, and to date have not seen evidence of any data having been published on the web,” UnitedHealth said. “And we are committed to providing appropriate support to people whose data is found to have been compromised.”
Rep. Jamie Raskin, D-Md., ranking member of the House Committee on Oversight and Accountability, wrote a letter to UnitedHealth CEO Andrew Witty on Monday requesting information about the “scope and extent” of the breach.
Raskin asked Witty for information about when Change Healthcare notified its clients about the breach, what specific infrastructure and information was targeted and what cybersecurity procedures the company has in place. The committee requested written responses “no later” than April 8.
“Given your company’s dominant position in the nation’s health care and health insurance industry, Change Healthcare’s prolonged outage as a result of the cyberattack has already had ‘significant and far-reaching’ consequences,” Raskin wrote.
The Biden administration also launched an investigation into UnitedHealth earlier this month due to the “unprecedented magnitude of the cyberattack,” according to a statement.
WATCH: UnitedHealth unit begins processing $14 billion medical claims backlog
Technology
EU seeks information from X on content moderation amid first major probe under new tech rules
Jonathan Raa | Nurphoto | Getty Images
The European Union is seeking information from social media platform X about cuts to its content moderation resources as part of its first major investigation into the company under its tough new laws governing online content.
The European Commission, the EU executive arm, said in a statement Wednesday that it’s requested information from X under the Digital Services Act, its groundbreaking tech law which requires online platforms to take a far stricter approach to policing illegal and harmful content on their platforms.
The Commission said it was concerned about X’s transparency report submitted to the regulator in March 2024, which showed it had cut its team of content moderators by nearly 20% compared to the number of moderators it reported in an early October 2023 transparency report.
X reduced linguistic coverage within the EU from 11 languages to seven, the Commission said, again citing X’s transparency report.
The Commission said it’s seeking further details from X on risk assessments and mitigation measures linked to the impact of generative artificial intelligence on electoral processes, dissemination of illegal material, and protection of fundamental rights.
X, which was formerly known as Twitter, was not immediately available for comment when contacted by CNBC.
X must provide information requested by the EU on its content moderation resources and generative AI requested by May 17, the Commission said. Remaining answers to questions from the Commission must be provided no later than May 27, the agency said.
The Commission said its request for information was a further step in a formal probe into breaches of the EU’s recently introduced Digital Services Act.
The Commission initiated formal infringement proceedings against X in December last year after concerns were raised over its approach to tackling illegal content surrounding the Israel-Hamas war.
The Commission at the time said its investigation would focus on X’s compliance with its duties to counter the dissemination of illegal content in the EU, the effectiveness of the social media platform’s steps to combat information manipulation and its measures to increase transparency.
EU officials said the requests for information aim to build on evidence gathered so far in relation to its DSA investigation into X. That evidence includes X’s March transparency report, as well as replies to previous requests for information addressing what X is doing to tackle disinformation risks linked to generative AI risks.
The DSA, which only came into effect in November 2022, requires large online platforms such as X to mitigate the risk of disinformation and institute rigorous procedures to remove hate speech, while balancing this with freedom-of-expression concerns.
Companies found to have breached the rules face fines as high as 6% of their global annual revenues.
Technology
Uber reports first-quarter results that beat expectations for revenue, but posts net loss
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports1 year agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Environment12 months agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Sports3 years ago
Team Europe easily wins 4th straight Laver Cup
-
Sports6 months agoGame 1 of WS least-watched in recorded history
-
Sports1 month agoStory injured on diving stop, exits Red Sox game
-
Environment1 year agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Environment1 year agoTesla advances Powerwall pilot project with German electric company